orca/config/reliability-gates.jsonc

{
  "schemaVersion": 1,
  "updatedAt": "2026-10-13",
  "policy": {
    "maturityLevels": ["experimental", "soak", "blocking", "accepted-gap", "deprecated"],
    "blockingPromotion": {
      "minimumSoakRuns": 100,
      "minimumSoakDays": 14,
      "maximumUnexplainedFlakes": 0
    }
  },
  "gates": [
    {
      "id": "terminal-output.resize-parse-barrier",
      "title": "Resize preserves queued parse barriers and following terminal output",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit-real-xterm",
      "surfaces": [
        "replay parse waits",
        "output scheduler parse waits",
        "write-pipeline health probes",
        "xterm resize"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1342 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Both installed browser and headless xterm packages run real parsing and resize with production replay, scheduler and health code. The shared renderer boundary applies to every provider and workspace kind; native Linux/Windows, live providers, mobile and rendered Electron acceptance are not exercised. Audit1342: src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts reduced. Barrier callback/write order, replay/output waits, health probe and repeated-barrier inventory samples disappear. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/26950",
        "https://github.com/stablyai/orca/pull/26956",
        "https://github.com/xtermjs/xterm.js/pull/6201"
      ],
      "invariant": "A resize must preserve every queued byte and invoke parse-barrier callbacks once in FIFO order. Replay and scheduler waits must finish from real parse progress, and a resized live parser must not be certified dead.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1342 retired changed-source receipts. Historical oracle account: Queue a barrier between before and after output, resize synchronously, and require both lines and ordered callbacks. Require replay and scheduler waits before timers advance; require live health after the probe deadline. Preserve partial UTF-8 and escape sequences, repeated no-resize barriers and subsequent writes.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1342 retired changed-source receipts; reduced selector has no new soak result. Historical account: One local focused green run; no soak or cross-platform runtime history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation. Historical account: Current-main production replay, scheduler and health consumers independently fail six real-runtime boundary checks. In the refreshed candidate, replacing only the singleton byte marker with an empty string fails10 of12 checked-in assertions; restoring it passes all12."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1342 changed test sources; no new measurement. Previous account: One shared zero-byte array; no new timers, polling, subprocesses or output bytes. One hundred repeated barriers preserve FIFO without per-call marker allocations."
      },
      "promotionCriteria": [
        "Collect stable CI and soak history across macOS, Linux and Windows.",
        "Exercise real local, daemon, SSH and paired-runtime panes through resize and restore."
      ],
      "knownGaps": [
        "No DOM, GPU or rendered Electron validation.",
        "No native Linux/Windows or live provider exercise; mobile terminal implementation is unchanged.",
        "Daemon headless-emulator async fallback empty-string marker is outside this renderer change; its normal synchronous path bypasses that marker.",
        "Separate upstream consumed-prefix replay and async-parser resize defects remain outside this workaround.",
        "Audit1342: src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts reduced. Barrier callback/write order, replay/output waits, health probe and repeated-barrier inventory samples disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts\",\n          \"durationSeconds\": 0.257,\n          \"summary\": \"12 tests pass against installed browser6.1.0-beta.304 and headless6.1.0-beta.303. Replacing only the helper marker with an empty string fails10 tests; the two no-resize controls still pass.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts\",\n    \"assertions\": [\n      \"fires its callback and keeps the writes queued behind it\",\n      \"lets a replay wait settle without falling back to its stall probe\",\n      \"settles the output scheduler wait before its fallback timer\",\n      \"keeps a resized live terminal healthy after the probe deadline\",\n      \"preserves partial UTF-8 and escape sequences without writing marker bytes\",\n      \"completes repeated barriers without a resize and permits subsequent writes\"\n    ]\n  }\n]",
        "Retired selector metadata during audit1345; historical selector record preserved unchanged: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts\"],\"testFiles\":[\"src/renderer/src/lib/pane-manager/xterm-parse-barrier.test.ts\"],\"assertionRefs\":[]}"
      ],
      "demotionRule": "Keep experimental until runtime history supports promotion; demote if callback ordering, byte preservation or health certification regresses."
    },
    {
      "id": "terminal-provider.windows-daemon-registry-package",
      "title": "Relocated Windows daemon retains the registry package runtime",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "package-copy-and-native-loader-contract",
      "surfaces": ["Windows daemon relocation", "Windows PATH registry refresh"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: On macOS, simulated win32 relocation copies the real workspace package manifest and root JS, and a child Node resolves the binary after install-tree removal. The fixture binary deliberately fails native loading; a Windows-only test reads HKLM with the actual built addon. Native Windows execution and packaged updater survival remain unproved locally.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/19522"],
      "invariant": "The relocated Windows daemon must retain the registry package root JS and native binary independently of its install tree, reject incomplete source or mirror files, and preserve an existing mirror while repairing it.",
      "oracle": "Run the real package JS from the relocated entry after deleting the install tree, reach its native loader, refuse each missing source file before staging, and replace each incomplete mirror without deleting its sentinel. Pin the real package name against the Windows packaging allowlist. On Windows, read ProductName through the built native addon from the mirror.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "focused package-copy and child Node loader contracts"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "No CI soak collected."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Original source fails seven new regressions: real package root missing, three incomplete sources accepted, three incomplete mirrors reused. Candidate passes locally; actual Windows native read remains skipped on macOS."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Three additional stat-validated cached hashes per source/mirror inventory; unchanged files do not reread bytes. Incomplete sources return before staging the Electron image. No polling, process enumeration, startup awaits or per-PTY work added."
      },
      "promotionCriteria": [
        "Run the native Windows loader test with release-built addon and packaged daemon relocation.",
        "Collect 100 CI passes or 14 days without unexplained flakes."
      ],
      "knownGaps": [
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "macOS fixture uses actual package JS and manifest with a placeholder binary; it proves resolution rather than Windows native behavior.",
        "No user PATH mutation, live Windows PTY spawn or NSIS update-survival replay.",
        "SSH/remote, WSL, mobile, macOS and Linux daemon launch paths are unchanged."
      ],
      "demotionRule": "Keep experimental until native Windows and package evidence exists; demote if incomplete sources repeatedly copy the runtime or repairs mutate active mirrors."
    },
    {
      "id": "terminal-lifecycle.closed-tab-create-admission",
      "title": "A shipped runtime refuses stale create identities after a durable tab close",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "sqlite-runtime-rpc-provider-contract",
      "surfaces": [
        "legacy paired terminal.create",
        "durable host close",
        "runtime spill partitions"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "paired-runtime", "ssh", "wsl", "mobile-relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1904 leaves this gate without any current active execution receipt. No current covered platform/provider or active selector/assertion claim remains; original valid source mappings are archived dormant, not asserted removed. Historical prior account (preserved verbatim): Real SQLite Store, renderer close entry, cold reload and registered terminal.create handler with a synthetic PTY controller on macOS. The workspace resolver supplies a fixture scope; no physical paired client or PTY is launched. Unseen identities and missing-PTY recovery retain spawn behavior. Other provider/platform execution is an explicit gap. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1366 deletes terminal-topology-commit.test.ts: five trace span attribute/kind/outcome/logging checks, including the narrow privacy-regex and rethrow alarm, are intentionally lost. Adjacent durable close/RPC tests are unchanged; no equivalent trace coverage is claimed. The mixed prior receipt is historical and cannot validate this reduced selector. Fresh validation remains required. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/21341#issuecomment-5770157948"],
      "invariant": "An unexpired durable tab-close record in any owning host partition must refuse a stale create of that tab in the same workspace before the PTY controller spawns. Unseen ids, panes with no tab-close record, expired records and split creation retain existing behavior; shipped layout ownership stays off.",
      "oracle": "Audit1904 retires the changed-selector receipt. The reduced source set has no current validated oracle; prior source requirements are historical until fresh execution. Historical prior account (preserved verbatim): Invoke the renderer close entry through a real SQLite Store, freeze and reopen the database, then invoke the registered paired terminal.create handler with the original tab/leaf hints and no command. Both local and runtime-spill close records must return tab_not_found with zero controller spawns and zero inventory reads, and no restored layout. Fresh identities, existing panes without a close record and expired records must still spawn.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical budget only: the original selector lost its sole active receipt and the reduced source set has no new measurement. Historical prior account (preserved verbatim): deterministic SQLite and runtime/provider contracts"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1904 has no current soak evidence for the reduced selector. Historical prior account (preserved verbatim): One focused 11-file pass on macOS; CI soak not collected."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1904 has no current red/green execution of the reduced selector. Historical prior account (preserved verbatim): On unmodified production code both actual close/cold-reload/RPC stale-id cases resolve successfully after spawning a replacement PTY; the unseen-id control passes. Admission guard makes both cases reject before the controller is invoked."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical policy/budget account only: no fresh performance or work-count validation of the reduced selector. Historical prior account (preserved verbatim): One constant-time tombstone lookup per existing host partition inside the already serialized explicit pane-admission mutation. No terminal inventory, filesystem scan, network call, subprocess, timer, retry or polling is introduced. Negative RPC controls assert zero spawn and zero inventory reads."
      },
      "promotionCriteria": [
        "Collect 100 CI passes or 14 days without unexplained flakes.",
        "Exercise live paired desktop wake and host restart on macOS, Linux and Windows."
      ],
      "knownGaps": [
        "No live sleep/wake, network RPC socket, actual PTY spawn or physical peer convergence was exercised; the registered handler and controller boundary are deterministic.",
        "The actual terminal.close handle path and physical renderer close delivery are covered by adjacent suites rather than this cold-reload oracle.",
        "Natural process exit and Sleep are not new close authority; only already-existing unexpired tab-close records gate creation. Live reconnects using mustExist continue to bypass fresh admission.",
        "Windows, Linux, WSL, SSH and phone execution were not physically run. Folder-workspace creation is unchanged but this new end-to-end fixture uses a repository workspace.",
        "Close records retain their existing 30-day TTL and per-partition cap of 500. No claim of permanent replay protection or complete issue resolution.",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-10-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-create-closed-tab-durability.test.ts src/main/runtime/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/orca-runtime-terminal-close-records.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/persistence/terminal-topology/terminal-topology-commit.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/terminal-close-observed-exit.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 23.76,\n          \"summary\": \"100 tests pass across 11 files, including cold SQLite close-record replay, fresh/unknown/expired controls, split replay, close write failure, idempotency and close lifecycle controls.\"\n        }",
        "Audit1366 deletes terminal-topology-commit.test.ts: five trace span attribute/kind/outcome/logging checks, including the narrow privacy-regex and rethrow alarm, are intentionally lost. Adjacent durable close/RPC tests are unchanged; no equivalent trace coverage is claimed. The mixed prior receipt is historical and cannot validate this reduced selector. Fresh validation remains required.",
        "Historical receipt retired by audit1366 at 25cd81665e1b8eaf75d7715d37999ca1583e1228; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-topology-commit.test.ts src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/orca-runtime-terminal-close-records.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/runtime/terminal-close-observed-exit.test.ts src/main/runtime/terminal-create-closed-tab-durability.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-create-closed-tab-durability.test.ts src/main/runtime/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/orca-runtime-terminal-close-records.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/persistence/terminal-topology/terminal-topology-commit.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/terminal-close-observed-exit.test.ts\",\n          \"durationSeconds\": 24.64,\n          \"summary\": \"Test Files  11 passed (11); Tests  97 passed (97). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"\n        }",
        "Audit1904 retires the sole active2026-11-04 Linux92tests/10files19.75s closed-tab receipt because it selects deleted terminal-pane-admission-taken-ids-switch-off. There is no fresh reduced-selector pass. Protection becomes none; active commands/testFiles/assertionRefs are cleared to satisfy the schema, with their complete original raw arrays preserved below as dormant historical source mappings. Clearing a valid mapping is not deletion of its surviving tests: source27 terminal-close-write-failure-switch-off and unrelated close/RPC assertions remain valid source bodies but have no active gate execution receipt. Lost source35 alarms: \"writes a client tab's second pane under the tab's id\"; 'writes a create under the id of a tab the user closed, on both pane write paths'. No equivalent replacement, fresh provider/platform, red/green, soak or budget evidence is claimed.",
        "Audit1904 historical closed-tab receipt and dormant selector/assertion inventory; not active execution or assertions for the reduced sources. Complete original raw subtrees follow verbatim.\nreceipt:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/terminal-create-closed-tab-durability.test.ts src/main/runtime/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/orca-runtime-terminal-close-records.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/terminal-close-observed-exit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-create-closed-tab-durability.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-records.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/terminal-close-observed-exit.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 19.75,\n          \"summary\": \"Test Files  10 passed (10); Tests  92 passed (92). Source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Current retained unit selection only. No removed-case replacement, live provider, native input, rendered Electron E2E, performance threshold or soak claim. Node24.22.0 with ORCA_BACKGROUND_LAUNCH=1 and an isolated Xvfb display. currentCommand retains the same selectors; execution adds a worker limit and disables dependency preflight.\"\n        }\ncommands:\n[\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-create-closed-tab-durability.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-replay-after-close.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-records.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts src/main/runtime/runtime-pane-admission.test.ts src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-no-widening.test.ts src/main/runtime/terminal-close-observed-exit.test.ts\"\n      ]\ntestFiles:\n[\n        \"src/main/runtime/terminal-create-closed-tab-durability.test.ts\",\n        \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-replay-after-close.test.ts\",\n        \"src/main/runtime/terminal/surface/orca-runtime-terminal-close-records.test.ts\",\n        \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n        \"src/main/runtime/runtime-pane-admission.test.ts\",\n        \"src/main/persistence/terminal-topology/terminal-pane-admission-taken-ids-switch-off.test.ts\",\n        \"src/main/persistence/terminal-topology/terminal-layout-create-resend.test.ts\",\n        \"src/main/persistence/terminal-topology/terminal-close-write-failure-switch-off.test.ts\",\n        \"src/main/runtime/terminal/surface/orca-runtime-terminal-close-no-widening.test.ts\",\n        \"src/main/runtime/terminal-close-observed-exit.test.ts\"\n      ]\nassertionRefs:\n[\n        {\n          \"file\": \"src/main/runtime/terminal-create-closed-tab-durability.test.ts\",\n          \"assertions\": [\"refuses a stale id closed in %s before spawning, including after restart\"]\n        }\n      ]"
      ],
      "demotionRule": "Keep experimental or demote if stale replay can spawn, unrelated/fresh panes are refused, the guard adds terminal inventory calls, a close loses durability, or focused ordering tests flake without an explained harness or product defect."
    },
    {
      "id": "agent-status.codex-hook-child-transcript-completion",
      "title": "Completed hook-only Codex children do not keep an idle pane working",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-status",
      "layer": "shared-provider-contract",
      "surfaces": ["Codex pane status", "subagent roster", "desktop and mobile status projection"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "ssh-relay", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "The entire shared hook-only child transcript suite and its sole dated receipt were retired by Audit1297. No active automated coverage, platform result or transport result remains for this gate. Audit1297: src/shared/codex-hook-child-transcript.test.ts removed. Lose live hook-only child settlement from JSONL, delayed-start nonresurrection, retained transcript root and explicit Stop overriding unflushed transcript samples. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["session:01a162f3-a20c-7601-b086-e5ed951caa1b"],
      "invariant": "Every hook-discovered Codex child with a known root transcript participates in bounded transcript reconciliation. A completed child cannot keep a done lead working when SubagentStop is missing, while a live child continues to hold the aggregate working. Explicit SubagentStop retires its transcript cursor.",
      "oracle": "No active automated oracle remains after removal of the hook-only child transcript suite. The invariant remains a risk requiring future validation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "Historical budget for the retired four-case suite; no active runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1297 retired the sole local execution receipt; no current selector or CI soak result remains."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1297 removed the authored red/green suite. Prior red/green account was: Before the fix the live child never schedules transcript polling and the delayed completed child reports working. Both regressions pass after enrollment in the existing reconciler."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit1297 removed the polling-completion and explicit-stop unit alarms. No active measurement validates those bounds. Prior account was: Reuses existing per-pane polling cadence, bounded 1 MB cursor reads and per-pass directory cache; adds no timers, subprocesses or global scans. Tests prove polling ends after completion and explicit stop."
      },
      "promotionCriteria": ["Collect CI soak evidence and exercise SSH, WSL, Linux and Windows."],
      "knownGaps": [
        "Hidden Electron CDP screenshots prove yellow Working becomes green Done after a hook-only child transcript completes. Hook events were simulated; no real provider turn, SSH/WSL transport or mobile UI exercised.",
        "A child lacking a known root transcript still relies on hook completion.",
        "Physical launch-before-transcript-flush races and cross-day resumed-child discovery remain outside this gate.",
        "Audit1297: src/shared/codex-hook-child-transcript.test.ts removed. Lose live hook-only child settlement from JSONL, delayed-start nonresurrection, retained transcript root and explicit Stop overriding unflushed transcript samples. No equivalent replacement coverage is claimed.",
        "Audit1297 retires this complete dated receipt because a source in its selector was removed. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/shared/codex-hook-child-transcript.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.768,\n          \"summary\": \"Four deterministic cases pass within the 127-test Codex regression suite. Actual 146 MB root rollout reconciles its completed hook-only child in approximately 10 ms with the existing 1 MB read cap.\"\n        }"
      ],
      "demotionRule": "Keep experimental until platform and transport gaps are covered; demote on false completion or polling that survives child retirement."
    },
    {
      "id": "agent-session.detached-account-restart-progress",
      "title": "Independent hidden account restarts progress within a shared spawn limit",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-store-provider-contract",
      "surfaces": [
        "hidden account-switch restart",
        "Codex restart notices",
        "Claude move-on-turn-end"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1391 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Real renderer store and scheduler with synthetic PTY IPC. Covers slot admission, later requests, prompt recovery, mounted ownership, stale replacement cleanup and executor reinstall. Physical PTYs and account switches remain unproved. Foreign-runtime and mobile execution are unchanged. Audit1391: src/renderer/src/components/terminal-pane/claude-detached-pane-restart.test.ts reduced. Missing-provider-session refusal/queue-consumption alarm removed. Retained cases cover actual resume replacement identity and turn-finish scheduling with fake PTY IO, not native process execution. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/22243"],
      "invariant": "One unresolved detached restart must not block independent accepted restarts, and after 90s it must re-ask instead of blocking silently. At most four unexpired claimed restarts may be in flight across sweeps; each claim must recheck current pane ownership before spawning and retain existing late-result adoption or reaping.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1391 retired changed-source receipts. Historical oracle account: Hold the first spawn pending and reject the second; require later panes to rebind and unblock. Add requests during a pending sweep and require four total in flight, with excess requests still queued. Free a slot after a queued tab mounts and require that mounted pane to remain untouched while another pane progresses. Reinstall the executor and settle an older claim to release a slot for new work. Stall four spawns past the deadline and require the fifth pane to restart, the stalled pane to ask again, and its late result to still adopt.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1391 retired changed-source receipts; reduced selector has no new soak result. Historical account: One local full gate pass; CI soak not collected."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1391 changed referenced test sources; no new red/green validation. Historical account: Original serial sweep strands pane three and admits only one later request. Generation-bound settlement callbacks strand the fifth pane after reinstall. All three regressions pass after fixes."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1391 changed test sources; no new measurement. Previous account: At most four claimed restart IPCs across all concurrent sweeps; fake-clock test verifies admission and slot reuse. One 90s per-claim timer frees a stalled slot and re-asks; no polling, retries, cancellation or process enumeration. Existing pending store is the queue; no second pending collection."
      },
      "promotionCriteria": [
        "Collect 100 CI passes or 14 days without unexplained flakes.",
        "Exercise live Codex and Claude hidden account-switch batches on Windows, Linux and macOS."
      ],
      "knownGaps": [
        "A stalled spawn is not cancelled; its pane re-asks after 90s and stays claimed until main settles. Why a real Windows spawn stalls is not proved.",
        "No live accounts, ConPTY, WSL or rendered prompt interaction exercised; no claim of closing broader restart/continuity reports.",
        "Remote-runtime and mobile detached executors are unchanged; foreign-machine PTYs still wait for mounted transport.",
        "Audit1391: src/renderer/src/components/terminal-pane/claude-detached-pane-restart.test.ts reduced. Missing-provider-session refusal/queue-consumption alarm removed. Retained cases cover actual resume replacement identity and turn-finish scheduling with fake PTY IO, not native process execution. No equivalent replacement coverage is claimed.",
        "Audit1391 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/account-restart-queue-progress.test.ts src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts src/renderer/src/components/terminal-pane/claude-detached-pane-restart.test.ts src/renderer/src/lib/agent-account-restart-startup.test.ts src/renderer/src/lib/codex-session-restart.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.52,\n          \"summary\": \"75 tests pass across five files. Initial serial code fails both progress regressions; a stale installation callback fails the reinstall regression until corrected.\"\n        }",
        "Audit1391 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local-daemon\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1391 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/account-restart-queue-progress.test.ts\",\n    \"assertions\": [\n      \"finishes later accepted panes while the first spawn stays pending and a second fails\",\n      \"admits later requests within a shared limit and rechecks mounted ownership as slots free\",\n      \"resumes queued work when a claim from an earlier executor installation settles\",\n      \"asks again and frees the slot when a spawn stalls, then adopts its late result\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts\",\n    \"assertions\": [\n      \"rejects a detached spawn after the tab generation and leaf owner change\",\n      \"keeps the replacement when a pane mounts during the spawn, since main already stopped the old PTY\"\n    ]\n  }\n]",
        "Audit1391 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/account-restart-queue-progress.test.ts\",\n          \"assertions\": [\n            \"finishes later accepted panes while the first spawn stays pending and a second fails\",\n            \"admits later requests within a shared limit and rechecks mounted ownership as slots free\",\n            \"resumes queued work when a claim from an earlier executor installation settles\",\n            \"asks again and frees the slot when a spawn stalls, then adopts its late result\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts\",\n          \"assertions\": [\n            \"rejects a detached spawn after the tab generation and leaf owner change\",\n            \"keeps the replacement when a pane mounts during the spawn, since main already stopped the old PTY\"\n          ]\n        }\n      ]",
        "Audit1391 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/account-restart-queue-progress.test.ts src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts src/renderer/src/components/terminal-pane/claude-detached-pane-restart.test.ts src/renderer/src/lib/agent-account-restart-startup.test.ts src/renderer/src/lib/codex-session-restart.test.ts\"],\"testFiles\":[\"src/renderer/src/components/terminal-pane/account-restart-queue-progress.test.ts\",\"src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts\",\"src/renderer/src/components/terminal-pane/claude-detached-pane-restart.test.ts\",\"src/renderer/src/lib/agent-account-restart-startup.test.ts\",\"src/renderer/src/lib/codex-session-restart.test.ts\"]}"
      ],
      "demotionRule": "Keep experimental or demote if pending work spins, the shared limit is exceeded, mounted owners are replaced, or stale results leak or overwrite newer panes."
    },
    {
      "id": "terminal-provider.retired-macos-daemon-recovery",
      "title": "Restart releases retired macOS daemon conversation owners across upgrades",
      "maturity": "experimental",
      "protection": "none",
      "owner": "daemon-terminal",
      "layer": "macos-daemon-lifecycle",
      "surfaces": [
        "Manage Sessions Restart",
        "agent conversation locks",
        "legacy terminal daemons"
      ],
      "platforms": ["macos"],
      "providers": ["local-daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Packaged GUI recovery is tested with deterministic job/process evidence and an isolated native launchd service holding a real advisory writer lock. Linux, Windows, Node/SSH hosts, WSL and mobile/relay do not execute GUI-service recovery; healthy legacy routing is unchanged.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/29130"],
      "invariant": "An explicit Restart may recover same-profile GUI services with retired endpoint ownership, including older protocols, only after exact job and root identity checks. It must verify descendants exited before releasing the job. Healthy, newer, foreign-profile, starting or unverifiable owners must not be stopped. Recovery failure is logged and must not block restarting the current daemon.",
      "oracle": "Recover an old-protocol conversation owner and require descendants to exit before the root is killed and its label released. Reject connected/unknown endpoints, present/unreadable ownership records, new processes, replaced jobs, recycled roots and failed descendant verification. Require recovery before current-session fanout, and a completed current-daemon restart if recovery fails.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "deterministic retired-job recovery and restart contract"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused local tests and native smoke pass; CI soak history is not yet collected."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The installed build restarted protocol 46 while a retired protocol 45 process retained 80 writer locks. The isolated native fixture now releases its real writer lock; automated baseline mutation evidence is not collected."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No startup work or periodic scans. One bounded launchctl list per explicit restart; at most 32 same-profile supported services. Only verified retired candidates invoke the existing bounded descendant verifier. Tests assert one discovery and one initial descendant capture per recovered job."
      },
      "promotionCriteria": [
        "Collect 100 focused CI passes or 14 days of soak history.",
        "Capture packaged upgrade and Restart recovery with multiple retired jobs."
      ],
      "knownGaps": [
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Full packaged GUI upgrade journey and multi-job native recovery remain uncollected.",
        "Recovery is specific to signed-helper launchd jobs; fork-launched and already reparented processes have no equivalent retained ownership evidence."
      ],
      "demotionRule": "Keep experimental or demote if recovery signals an unverified owner, treats loss of contact as exit, reports success before descendant exit, adds background scanning, or lets a recovery failure block the current-daemon restart."
    },
    {
      "id": "agent-session.delayed-terminal-launch",
      "title": "Delayed terminal launches retain their harness preparation and recover process discovery",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "host-renderer",
      "surfaces": [
        "terminal startup commands",
        "typed agent commands",
        "hidden terminal startup",
        "agent hooks and managed accounts"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1402 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Shared preparation is exercised with real local plugin files and account environment plus mocked host spawn contracts. Captured real Claude startup title drives renderer recovery. Physical Linux, Windows, SSH and WSL delayed launches remain unproved. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["docs/bug-reproductions/delayed-agent-launch.md"],
      "invariant": "A literal sleep followed by && must not cause the later harness to lose hook/account preparation or hidden renderer query delivery. Preparation and typed-command hints are not live process evidence. Fresh agent startup output may request one bounded host confirmation after the initial command read window has expired.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1402 retired changed-source receipts. Historical oracle account: Delayed OpenCode 2 installs v2 hooks rather than v1, disabled harnesses do not fall back, selected managed accounts survive, and Pi/OMP/Prime preparation targets the requested harness. A captured Claude startup title at 30 seconds yields process-confirmed routing, never title-authorized routing. A title storm causes at most three additional reads; close and untrackable providers cause none.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1402 changed test sources; no new measurement. Previous account: Prefix scanning is capped at 4096 characters; ordinary output has no additional work. Startup title recovery uses one existing three-read ladder per command and joins active reads. Deterministic counts cover storms, close and untrackable providers."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1402 retired changed-source receipts; reduced selector has no new soak result. Historical account: Focused macOS runs passed; no cross-platform soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1402 changed referenced test sources; no new red/green validation. Historical account: Before the fix, delayed preparation produced 52 failing assertions and the captured late Claude startup title left process routing unset. The corresponding tests passed after the change."
      },
      "promotionCriteria": [
        "Collect repeated independent runs and physical provider/platform evidence before promotion."
      ],
      "knownGaps": [
        "Real Claude hooks completed normally in the original macOS reproduction; no blanket hook outage was reproduced.",
        "Literal numeric sleep prefixes only; arbitrary shell scripts, variables, separators, background jobs and pipelines remain unmodeled.",
        "Physical Linux, Windows, SSH, WSL and remote-runtime delayed launches and all-harness live CLI runs were not performed.",
        "A late agent emitting neither an identifiable startup title nor hook evidence still needs a later visibility/input observation.",
        "Retired during audit1345 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-10-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-command-line-intent.test.ts src/shared/pi-agent-kind.test.ts src/shared/opencode-launch-command.test.ts src/main/ipc/pty/host-env/opencode-hook-installation.test.ts src/main/ipc/pty-spawn-env-terminal-basics.test.ts src/main/managed-data-accounts/launch-environment.test.ts src/renderer/src/components/terminal-pane/terminal-startup-command-classifier.test.ts src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":1.86,\"summary\":\"214 assertions pass across nine files, including all 45 harness classifications, actual hook files, delayed account preparation, late process routing, hidden query delivery and bounded recovery.\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-launch/startup/agent-command-line-intent.test.ts src/shared/pi-agent-kind.test.ts src/shared/opencode-launch-command.test.ts src/main/ipc/pty/host-env/opencode-hook-installation.test.ts src/main/ipc/pty/pty-spawn-env-terminal-basics.test.ts src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts --maxWorkers=2\"}",
        "Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed.",
        "Audit1402 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/host-env/opencode-hook-installation.test.ts src/main/ipc/pty/pty-spawn-env-terminal-basics.test.ts src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts src/shared/agent-launch/startup/agent-command-line-intent.test.ts src/shared/opencode-launch-command.test.ts src/shared/pi-agent-kind.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-launch/startup/agent-command-line-intent.test.ts src/shared/pi-agent-kind.test.ts src/shared/opencode-launch-command.test.ts src/main/ipc/pty/host-env/opencode-hook-installation.test.ts src/main/ipc/pty/pty-spawn-env-terminal-basics.test.ts src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 23.37,\n          \"summary\": \"Test Files  8 passed (8); Tests  332 passed (332). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"\n        }",
        "Audit1402 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1402 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/ipc/pty/host-env/opencode-hook-installation.test.ts\",\n    \"assertions\": [\n      \"explicit %s with disabled\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts\",\n    \"assertions\": [\n      \"bounds a startup title storm to one extra read ladder and never adopts the title as identity\",\n      \"cancels delayed startup discovery on close\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\n    \"assertions\": [\n      \"confirms a delayed Claude from fresh startup output after the first read window expires\"\n    ]\n  }\n]",
        "Audit1402 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/ipc/pty/host-env/opencode-hook-installation.test.ts\",\n          \"assertions\": [\"explicit %s with disabled\"]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts\",\n          \"assertions\": [\n            \"bounds a startup title storm to one extra read ladder and never adopts the title as identity\",\n            \"cancels delayed startup discovery on close\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\n          \"assertions\": [\n            \"confirms a delayed Claude from fresh startup output after the first read window expires\"\n          ]\n        }\n      ]",
        "Audit1402 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-launch/startup/agent-command-line-intent.test.ts src/shared/pi-agent-kind.test.ts src/shared/opencode-launch-command.test.ts src/main/ipc/pty/host-env/opencode-hook-installation.test.ts src/main/ipc/pty/pty-spawn-env-terminal-basics.test.ts src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts --maxWorkers=2\"],\"testFiles\":[\"src/shared/agent-launch/startup/agent-command-line-intent.test.ts\",\"src/shared/pi-agent-kind.test.ts\",\"src/shared/opencode-launch-command.test.ts\",\"src/main/ipc/pty/host-env/opencode-hook-installation.test.ts\",\"src/main/ipc/pty/pty-spawn-env-terminal-basics.test.ts\",\"src/renderer/src/components/terminal-pane/pane-delayed-agent-startup.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\"]}"
      ],
      "demotionRule": "Keep experimental until soak evidence; investigate failures without widening polling windows, trusting titles or weakening hook/account assertions."
    },
    {
      "id": "native-chat.transcript-consumed-boundary",
      "title": "Transcript replacement remains visible when it races message publication",
      "maturity": "experimental",
      "protection": "none",
      "owner": "native-chat",
      "layer": "host-file-reader-and-renderer",
      "surfaces": ["native chat live transcript"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1662 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real local JSONL files exercise the shared host reader with Claude records; hidden Electron proof traverses actual host IPC and chat rendering. No physical remote or Windows/Linux deployment claim.",
      "motivatingLinks": ["https://github.com/stablyai/orca/actions/runs/37524761640"],
      "invariant": "A retained transcript cursor fingerprint contains only bytes actually consumed at that cursor. A larger in-place rewrite during publication must be delivered, and subsequent ordinary appends arrive once. Closing or failing a test leaves no active watcher.",
      "oracle": "Synchronous larger rewrites during append, initial snapshot and replacement snapshot callbacks deliver new exactly once, followed by followup exactly once. A 4 MiB read retains an independent 64-byte backing allocation. Hidden Electron reproduces the same ordering at snapshot IPC publication and asserts the new rendered text replaces the old conversation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Focused local unit command; CI/platform soak not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Deterministic publication ordering replaces a timing-dependent filesystem race; no long-term soak claim."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Identical append callback regression fails on parent main with only old observed and passes with consumed-byte fingerprinting."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "At most 64 owned, unpooled bytes per cursor. Fingerprint capture reuses already-read chunks and removes the post-publication filesystem read; no new timers, polls or subprocesses."
      },
      "knownGaps": [
        "Audit1662 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Physical SSH/WSL/runtime hosts and native Linux/Windows remain unverified.",
        "This gate targets rewrites during publication, not atomic snapshots of arbitrary concurrent multi-chunk file overwrites."
      ],
      "promotionCriteria": [
        "Collect policy soak and native/remote host evidence without weakening delivery or resource assertions."
      ],
      "demotionRule": "Remain experimental until soak and platform coverage; investigate missing replacements without retries or longer timeouts."
    },
    {
      "id": "terminal-input.prompt-reply-occurrence-acknowledgment",
      "title": "Terminal chat replies hide only the acknowledged prompt occurrence",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "renderer-mobile-provider-contract",
      "surfaces": [
        "desktop terminal chat prompt cards",
        "mobile terminal chat composer",
        "verified PTY input and paced answers"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed.  Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/session/mobile-prompt-controller.test.ts, tests/e2e/native-chat-ssh-delivery.unit.test.ts, mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Historical scope: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1471 removes the entire interactive-send hook suite. Its mock-writer routing, cancellation-handle, option-digit, interrupt, supplied settlement and inference-argument alarms are retired. No actual PTY bytes, replacement question lifetime or agent delivery were exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Audit1468 removes the entire runtime-send suite. Its mock PTY clear/body/Enter byte-order, nominal timing, queue cancellation/serialization, attachment escaping, key-group pacing and deferred acceptance callback alarms are intentionally retired. No actual receiving agent or physical terminal delivery was exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts: Loses configured retry gap and single-Enter agent selection alarms alongside forbidden timer-count checks. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1316 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Production mobile controller, parser, presentation, overlay, view, question, permission and composer run with native surfaces mocked on macOS. Desktop selector groups traverse the real observed-write queue, verified helper, IPC chunker, SSH provider and transport callbacks; paired sends traverse the real dispatcher and runtime writer into that provider. Local/daemon contracts and released-version terminal codecs are covered. Provider labels describe contracts, not physical deployments; physical WSL/Linux/Windows remain gaps. Audit885 removes the isolated observed-send mock-call suite; no replacement-equivalence claim is made. Audit1107 removes the small healthy ordinary SSH-send byte/callback sample. Its exact clear/body/Enter sample alarm is lost; retained slow-answer, cancellation and simulated older-host sequence checks are not claimed as equivalent replacement coverage. The SSH delivery fixture uses controlled fake provider settlement, and its paired path uses the real runtime/dispatcher without a physical SSH or paired wire transport. Audit1278 removes the mobile Stop display/disabled/placeholder suite; its local Stop presentation, repeat-stop and dispatch-visibility alarms are intentionally lost. No equivalent replacement or runtime stopping proof is claimed. Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed. Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation. Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed. Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed. Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed. Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts removed. Intentionally loses clear-confirmation/body/submit and maximal-clear ordering, queued text/image send ordering, ordinary cursor-spanning draft replacement and oversized refusal/queue settlement alarms. No equivalent replacement or real terminal delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1426 removes NativeChatComposer.test.tsx. Local pane-remount, draft/cancel/confirmation sequencing and manual IME callback alarms are lost. No equivalent replacement coverage or provider delivery is claimed; historical receipts retain their original scope and the reduced selector has no new execution result. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/25761"],
      "invariant": "A prompt occurrence leaves the input region only when an accepted reply answers it (a current host's provider acknowledgment, or an older host's whole-write acceptance as before) or the user collapses it to a strip above the composer, which writes nothing and keeps the card mounted with its partial answer; status-backed occurrences are told apart by the host wait's start, so view toggles and remounts preserve them while real clear/replacement supersedes them, and a transcript-only one is dropped when the view stops observing it; obsolete results cannot change replacements; selector groups wait for complete writes before pacing; refusal or unknown handoff never causes replay; a card retires an unsubmitted composer send without writing under it or losing its text, and the hidden composer cannot send or interrupt; Collapse or Escape folds a card without writing, never during an in-flight answer, and a new occurrence shows expanded again; the phone blocks only Send while a card is expanded and shows one card per occurrence; cancellation stops unsent groups and active dictation can stop.",
      "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed.  Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed. Historical prior account (preserved verbatim): Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Historical oracle: Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): After acknowledged phone replies with stale host status, the exact card disappears and Send is enabled; unknown, refused or unverifiable-settlement replies retain enabled choices, while an older host's accepted reply dismisses like an acknowledged one; a same-occurrence view toggle retains pending acknowledgment and real replacements discard it. A slow 32 KiB SSH answer completes all chunks before Enter; cancellation preserves issued bytes but omits remaining groups. Paired settlement invokes the actual provider and lost callbacks remain unknown; older hosts deliver ordinary messages, launch and selector groups once and their accepted answers dismiss as before. An answered card stays hidden across a view remount; a collapsed card is a strip that frees the composer and expands back; an identical question in a new wait shows again; a composer send caught by a new card keeps its bubble without submitting or clearing the line under it. Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/terminal/input/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts --maxWorkers=2",
        "ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts --maxWorkers=2",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --maxWorkers=1",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2",
        "ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts --maxWorkers=2"
      ],
      "testFiles": [
        "src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx",
        "src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx",
        "src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx",
        "src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx",
        "src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts",
        "src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts",
        "src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts",
        "src/main/ipc/pty/ipc/write-input-user-input.test.ts",
        "src/main/ipc/pty/pty-write-ipc-validation.test.ts",
        "src/main/runtime/terminal/input/runtime-terminal-writer.test.ts",
        "src/main/runtime/rpc/terminal-send.test.ts",
        "mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts",
        "tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx",
          "assertions": [
            "ignores a raw acknowledgment from a rebound PTY",
            "sends only one cancellation, can cancel an answer, and permits retry after unknown"
          ]
        },

        {
          "file": "mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts",
          "assertions": [
            "retains permission choices on %s",

            "keeps an acknowledged Deny hidden after the chat screen remounts on a lingering status",
            "settles the terminal answer for Q1 after Q2 arrives without hiding Q2",
            "keeps structured answer controls after a thrown send"
          ]
        },
        {
          "file": "src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx",
          "assertions": [
            "keeps an in-flight message visible and never submits it into the approval",
            "routes no typing to the hidden composer until the card is answered"
          ]
        },
        {
          "file": "src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx",
          "assertions": [
            "keeps an answered approval hidden across a chat view remount and a PTY rebind"
          ]
        },
        {
          "file": "src/main/runtime/terminal/input/runtime-terminal-writer.test.ts",
          "assertions": [
            "waits for complete body settlement before Enter",
            "does not send the suffix after refusal or unknown settlement",
            "returns unknown after an acknowledged prefix followed by refusal or bookkeeping failure",
            "preserves legacy raw body and Enter writes"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-10-06",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --maxWorkers=1",
          "result": "passed",
          "durationSeconds": 25.68,
          "summary": "10 terminal wire codec compatibility cases passed against current and two supported released source versions; this is a codec/RPC-reader contract, not a physical mixed-version paired deployment."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 300,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured. Prior scope: Historical prior-selector budget; changed selectors have no new runtime measurement. Unchanged receipts apply only to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "No fresh soak validates the reduced sources. Historical account: {\"status\":\"not-started\",\"evidence\":\"Audit1383 changed selectors have no new soak result. Historical account: Changed selectors have no new soak result after Audits1340 and1348; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1316; any retained unchanged-source receipts apply only to their own commands. Historical account: Local regression runs passed; cross-platform CI soak has not started.\"}"
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "No fresh red/green validates the reduced sources. Historical account: {\"status\":\"missing\",\"evidence\":\"Audit1383 changed test sources; no new red/green validation of reduced selectors. Historical account: Audits1340 and1348 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1316 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Immutable 8b2538 baseline reproduced Enter overtaking the SSH body and paired raw acceptance without provider settlement. Desired-behavior ablations replacing only baseline mobile sender/occurrence modules fail five of fourteen cases; replacing selector scheduling fails one of six; replacing paired runtime writer fails two of six. The entire gate has not been reverted, and rendered/platform soak remains absent.\"}"
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh reduced-source performance measurement is claimed. Historical account: Historical prior-selector budget; changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. No polling, subprocess, startup await, new status producer or dismissal timer. Reuses the existing bounded per-tab committed observation and per-PTY queue; waits for each group before its existing pacing timer. Duplicate-cancel and yielding chunk tests bound writes. Optional paired proof reuses provider settlement only for requesting clients; legacy requests keep their raw path."
      },
      "knownGaps": [
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1471 removes the entire interactive-send hook suite. Its mock-writer routing, cancellation-handle, option-digit, interrupt, supplied settlement and inference-argument alarms are retired. No actual PTY bytes, replacement question lifetime or agent delivery were exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope.",
        "Audit1468 removes the entire runtime-send suite. Its mock PTY clear/body/Enter byte-order, nominal timing, queue cancellation/serialization, attachment escaping, key-group pacing and deferred acceptance callback alarms are intentionally retired. No actual receiving agent or physical terminal delivery was exercised. No equivalent replacement or fresh execution of the reduced reliability selector is claimed; historical receipts retain their original scope.",
        "Audit1458 removes NativeChatApprovalCard.test.tsx. Its supplied subject/button/callback, text inventory and happy-dom focus/containment alarms are intentionally lost. No equivalent replacement coverage or native focus/provider acknowledgment proof is claimed. Historical execution receipts retain their original commands and scope; reduced commands have no fresh execution result.",
        "Historical receipt before suite removal; its original command and results are preserved without assigning them to remaining tests: {\"date\":\"2026-10-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/use-mobile-native-chat-controller.test.ts mobile/src/session/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/MobileNativeChatView.stop.test.ts mobile/src/session/MobileNativeChatView.failure-banner.test.ts mobile/src/session/MobileNativeChatView.rows.test.ts mobile/src/session/MobileNativeChatView.composer-lock.test.ts mobile/src/session/MobileNativeChatView.tail-follow.test.ts mobile/src/session/MobileNativeChatView.history-paging.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.stop.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.rows.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":10.32,\"summary\":\"73 tests passed across four explicit files after the controller extraction, covering the production view/card/composer, occurrence dismissal, controller session scoping, unknown/refused replies and stopping active dictation.\"}",
        "Historical receipt before suite removal; its original command and results are preserved without assigning them to remaining tests: {\"date\":\"2026-10-06\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/use-mobile-native-chat-controller.test.ts mobile/src/session/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/MobileNativeChatView.stop.test.ts mobile/src/session/MobileNativeChatView.failure-banner.test.ts mobile/src/session/MobileNativeChatView.rows.test.ts mobile/src/session/MobileNativeChatView.composer-lock.test.ts mobile/src/session/MobileNativeChatView.tail-follow.test.ts mobile/src/session/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/mobile-native-chat-permission-send.test.ts mobile/src/session/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/use-mobile-native-chat-answer-send.test.ts mobile/src/session/use-mobile-native-chat-message-send.test.ts mobile/src/session/mobile-native-chat-send.test.ts mobile/src/session/MobileNativeChatCardHeaderAction.test.tsx mobile/src/session/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":1.19,\"summary\":\"186 tests passed across 12 explicit files after the round-3 review fixes, including older-host answers dismissing like acknowledged ones, collapse that keeps the card mounted, one card per occurrence, wait-start question identity and only Send blocked.\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.stop.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.rows.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts mobile/src/session/native-chat/mobile-native-chat-send.test.ts mobile/src/session/native-chat/MobileNativeChatCardHeaderAction.test.tsx mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\"}",
        "Provider acknowledgment proves handoff, not agent consumption or prompt closure; a host prompt gate remains deferred pending captured closing lifecycles.",
        "Rendered Electron and physical mobile/microphone behavior require remote QA; native surfaces are mocked in these unit tests.",
        "Physical WSL, Linux/Windows, paired mixed-version deployment and network fault campaigns have not been exercised.",
        "Older hosts provide whole-write handoff only; their accepted answers dismiss the card as before, without provider acknowledgment.",
        "A transcript-only question has no wait start: after the view stops observing it, a collapse or answer is dropped and the card shows again.",
        "Cancelling a paced answer stops future groups; bytes already handed to the provider, including pending chunks, can still settle.",
        "Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed.",
        "Audit1292 retired the complete dated receipt after removal of a source in its command. Its results do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-06\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-observed-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/runtime/runtime-terminal-verified-input.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-send-launch-draft-resolution.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 14.53,\n          \"summary\": \"391 tests passed across 29 explicit files after the round-4 review fix, including older-host acceptance, the inert hidden composer, collapse that keeps a partial answer and returns focus to the composer, pane-scoped card focus, wait-start occurrence identity and the pane remount signal.\"\n        }",
        "Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed.",
        "Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-observed-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 232.36,\n          \"summary\": \"257 tests passed across 19 explicit files, covering production cards, observed sends, existing launch/paste callers, IPC validation, SSH acknowledgment and daemon settlement recovery.\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-followup-delivery.test.ts src/main/ipc/pty/ipc/write-input-acceptance.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/daemon/daemon-pty-write-settlement-recovery.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 39.77,\n          \"summary\": \"Test Files  24 passed (24); Tests  326 passed (326). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed.",
        "Archived audit1303 retired-suite historical receipt (JSON; original command/currentCommand/results/counts unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1295-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts mobile/src/session/native-chat/mobile-native-chat-send.test.ts mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts mobile/src/session/native-chat/mobile-native-chat-send.test.ts mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":3.85,\"summary\":\"Test Files  13 passed (13); Tests  205 passed (205). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation.",
        "Archived audit1310 historical receipt (original command/currentCommand/result/count/duration unchanged; not evidence for the shortened suite): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1295-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts mobile/src/session/native-chat/mobile-native-chat-send.test.ts mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts mobile/src/session/native-chat/MobileNativeChatView.history-paging.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts mobile/src/session/native-chat/mobile-native-chat-send.test.ts mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":3.85,\"summary\":\"Test Files  13 passed (13); Tests  205 passed (205). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed.",
        "Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed.",
        "Audit1340 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"remote-runtime\",\"mobile-relay\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed.",
        "Audit1348 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"remote-runtime\",\"mobile-relay\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed.",
        "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 31.72,\n          \"summary\": \"Test Files  20 passed (20); Tests  310 passed (310). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 15.57,\n          \"summary\": \"Test Files  13 passed (13); Tests  218 passed (218). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 30.79,\n          \"summary\": \"Test Files  20 passed (20); Tests  310 passed (310). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 15.79,\n          \"summary\": \"Test Files  13 passed (13); Tests  218 passed (218). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit1383 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Static assertion references are not current execution evidence.",
        "Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1402: src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts removed. Intentionally loses clear-confirmation/body/submit and maximal-clear ordering, queued text/image send ordering, ordinary cursor-spanning draft replacement and oversized refusal/queue settlement alarms. No equivalent replacement or real terminal delivery claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1417 intentionally reduces src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts: Loses configured retry gap and single-Enter agent selection alarms alongside forbidden timer-count checks. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1426 removes NativeChatComposer.test.tsx. Local pane-remount, draft/cancel/confirmation sequencing and manual IME callback alarms are lost. No equivalent replacement coverage or provider delivery is claimed; historical receipts retain their original scope and the reduced selector has no new execution result.",
        "Audit1908 removes the complete prompt-presentation hook and literal interactive-protocol mapping suites and narrows the interactive card and prompt-card input suites. Lost alarms include replacement approval A settling after answered B; collapse/expand composer ownership and partial-answer presentation; identical new waits after an unmounted view; collapsed transcript re-reads; answered/dismissed status-backed persistence and retirement; and literal answer-to-PTY byte arrays. The retained stale-PTY acknowledgment, cancellation/answer retry, and answered-approval remount/rebind assertions remain meaningful but are not equivalent replacement coverage. No fresh reduced-selector result, physical provider, rendered/native-focus, mixed-version deployment, soak, or measured-budget validation is claimed. The unchanged wire-codec receipt remains valid only for its exact command. Exact retired direct alarms: 'ignores approval A settling after answered replacement B'; 'replaces the composer and hides only once the choice was delivered'; 'keeps the card answerable when the choice was refused or its delivery is unknown'; 'collapses the approval on %s without writing, until a new wait shows it again'; 'shows a second approval with the same text once it is a new wait'; 'routes question Cancel to rejection and releases the composer slot without Stop'; 'cannot collapse a question while its answer is still being written'; 'keeps the question when its Cancel was not delivered'; 'keeps a verified send visible until delivery succeeds'; 'restores a verified send for retry when delivery is rejected'; 'stays dismissed after answering while the transcript call is still pending'; 'clears once the FIFO tool result lands'; 'retains terminal choices across an agent notice until legacy human input'; 'filters Q1 before grouping Q2 and never writes Cancel, including window movement'; 'resets an edited pending form without unmounting its answer owner'; 'underlines an existing file in the plan and opens it through the chat'; 'shows an identical question again in a new wait that arrived while the view was unmounted'; 'keeps a collapsed transcript question collapsed while the transcript re-reads'; 'keeps a partly answered question across collapse and expand, and Escape in its text field'; 'keeps one line per question with a blank middle answer (3 questions)'; 'single-select: sends the picked option NUMBER (not the label), no trailing Enter'; 'single-select free text: opens \"Type something\" then types the answer + Enter'; 'multi-select: toggles each option NUMBER, then steps to Submit and confirms'; 'multi-question: steps past an unanswered question then submits'; 'preview single-select: focuses the option number, notes free text, then commits with Enter'; \"submits the final multi-question option without Claude's extra Enter\"; 'adds free text as notes before committing the selected row'; \"targets Codex's synthetic None-of-the-above row for a custom answer\"; 'clears skipped rows and confirms the partial answer once'; 'keeps a status-backed answer hidden for a remounted view'; 'shows an identical question again once the prompt cleared'; 'forgets the dismissal when its tab retires'.",
        "Audit1908 historical original assertion objects; only the five identified retired assertion titles are removed from active refs. Remaining titles stay active. Complete original raw assertion objects follow verbatim:\n{\n          \"file\": \"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\n          \"assertions\": [\n            \"ignores approval A settling after answered replacement B\",\n            \"ignores a raw acknowledgment from a rebound PTY\",\n            \"sends only one cancellation, can cancel an answer, and permits retry after unknown\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\n          \"assertions\": [\n            \"keeps an answered approval hidden across a chat view remount and a PTY rebind\",\n            \"collapses to a strip that frees the composer, and expanding gives the card the input back\",\n            \"shows an identical question again in a new wait that arrived while the view was unmounted\",\n            \"keeps a collapsed transcript question collapsed while the transcript re-reads\",\n            \"keeps a partly answered question across collapse and expand, and Escape in its text field\"\n          ]\n        }",
        "Audit1991: Remove partial-runtime terminal-send guard/status/floor/query projection and argument-inventory samples. Retained RPC viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences remain bounded mock-boundary behavior. The unchanged wire-codec receipt remains valid only for its original command; it does not validate this reduced RPC selector. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003: Remove agent-prompt absence routing, throwing/live/missing-probe and cached-probe-count examples from the stale-leaf source. Controller-proven absence, unknown-liveness admission, obsolete-absence clearing and same-ID respawn fences remain at a supplied provider/row seam. Preserve the independent wire-codec receipt only in its original scope. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/session/mobile-prompt-controller.test.ts, tests/e2e/native-chat-ssh-delivery.unit.test.ts, mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts.",
        "Historical assertion references before mobile owner-layout policy; removed references have no replacement claim: [{\"file\":\"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\"assertions\":[\"ignores a raw acknowledgment from a rebound PTY\",\"sends only one cancellation, can cancel an answer, and permits retry after unknown\"]},{\"file\":\"mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts\",\"assertions\":[\"a late answer cannot reshow an answered replacement occurrence\",\"a late answer cannot dismiss a replacement session\"]},{\"file\":\"mobile/src/session/mobile-prompt-controller.test.ts\",\"assertions\":[\"finishes an older-host selector once and dismisses it like an acknowledged answer\",\"dismisses older-host approval choice %i like an acknowledged answer and restores Send\",\"retains permission choices on %s\",\"acknowledges the same pending %s after a view-only toggle\",\"shows a collapsed prompt again as a new wait\",\"keeps an acknowledged Deny hidden after the chat screen remounts on a lingering status\",\"drops an accepted result after real %s replacement\",\"keeps an agent notice answerable and retires only human input through the %s view\",\"retains exact cancelled calls through edits, prefix/ID replay, paging and new equal rows (%s)\",\"keeps structured %s admission separate from captured Cancel and delivered rows\",\"settles the terminal answer for Q1 after Q2 arrives without hiding Q2\",\"fences a late captured structured answer after %s replacement\",\"does not turn real %s host-result conversion into an answered question\",\"keeps later same-ID Cancel after eviction/reentry and old answer settlement\",\"keeps structured answer controls after a thrown send\",\"isolates equal portable IDs on two hosts and rejects the old host callback\"]},{\"file\":\"tests/e2e/native-chat-ssh-delivery.unit.test.ts\",\"assertions\":[\"serializes every chunk of a healthy large SSH answer before Enter and dismissal\",\"cancels remaining paced groups while an already-issued body still settles\",\"paired terminal.send uses provider settlement for accepted and lost acknowledgment\",\"older paired hosts keep their whole-write verdict for answers and ordinary sequences\",\"older paired hosts confirm ordinary chat sends and pasted answers as before\",\"finishes every older-host selector group once and settles the answer as delivered\"]},{\"file\":\"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\"assertions\":[\"keeps an in-flight message visible and never submits it into the approval\",\"routes no typing to the hidden composer until the card is answered\"]},{\"file\":\"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\"assertions\":[\"keeps an answered approval hidden across a chat view remount and a PTY rebind\"]},{\"file\":\"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts\",\"assertions\":[\"waits for complete body settlement before Enter\",\"does not send the suffix after refusal or unknown settlement\",\"returns unknown after an acknowledged prefix followed by refusal or bookkeeping failure\",\"preserves legacy raw body and Enter writes\"]}]",
        "Audit2251 narrows agent-paste-draft.test.ts from 25 authored cases (26 literal cases) to four. Retained cases cover buffered readiness on PTY binding, separate spawn/composer lifetimes, real per-PTY paste/Enter serialization against a competing paste, and frame closure/no Enter after a rejected content chunk. Intentionally lost alarms include agent marker and fallback examples, direct-write failure/rejection, missing-PTY and Codex process-only timeout paths, exact nonprimary-PTY routing, full large-body chunk reconstruction, escaping/CRLF samples, internal laziness/yield work assertions, oversized preflight refusal, and exact configured delay/budget counts. No equivalent replacement, new execution, real PTY/provider delivery, rendered/native UI, deployment, measured performance or cross-platform result is claimed.",
        "Audit2450 removes the MobileNativeChatView failure-banner callback-only example whose old banner is supplied unchanged by its props. Retain fatal-read gating and the ordering test that preserves a new delivery notice. The removed false-send/old-banner combination has no equivalent replacement; prior raw receipts and budgets retain their original source scope. No new soak, platform, performance or red/green claim.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The entire mocked mobile failure-banner suite and its sole send/previous-banner/new-notice ordering alarm are retired. Its filenames are removed from active selectors. Desktop prompt roots and the independent unchanged terminal wire-codec receipt remain at their stated scopes; no mobile send/recovery proof is claimed.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged. Original active selector fields (historical complete raw JSON values, not current coverage): commands: [\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/terminal/input/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal/input/terminal-send-stale-leaf-liveness.test.ts --maxWorkers=2\",\n        \"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts --maxWorkers=2\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --maxWorkers=1\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\n        \"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts --maxWorkers=2\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\n        \"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\n        \"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\n        \"src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx\",\n        \"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts\",\n        \"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts\",\n        \"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts\",\n        \"src/main/ipc/pty/ipc/write-input-user-input.test.ts\",\n        \"src/main/ipc/pty/pty-write-ipc-validation.test.ts\",\n        \"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts\",\n        \"src/main/runtime/rpc/terminal-send.test.ts\",\n        \"src/main/runtime/terminal/input/terminal-send-stale-leaf-liveness.test.ts\",\n\n        \"mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts\",\n        \"mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts\",\n        \"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\n          \"assertions\": [\n            \"ignores a raw acknowledgment from a rebound PTY\",\n            \"sends only one cancellation, can cancel an answer, and permits retry after unknown\"\n          ]\n        },\n\n        {\n          \"file\": \"mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts\",\n          \"assertions\": [\n            \"retains permission choices on %s\",\n\n            \"keeps an acknowledged Deny hidden after the chat screen remounts on a lingering status\",\n            \"settles the terminal answer for Q1 after Q2 arrives without hiding Q2\",\n            \"keeps structured answer controls after a thrown send\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\n          \"assertions\": [\n            \"keeps an in-flight message visible and never submits it into the approval\",\n            \"routes no typing to the hidden composer until the card is answered\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\n          \"assertions\": [\n            \"keeps an answered approval hidden across a chat view remount and a PTY rebind\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts\",\n          \"assertions\": [\n            \"waits for complete body settlement before Enter\",\n            \"does not send the suffix after refusal or unknown settlement\",\n            \"returns unknown after an acknowledged prefix followed by refusal or bookkeeping failure\",\n            \"preserves legacy raw body and Enter writes\"\n          ]\n        }\n      ]",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The stale-leaf-liveness suite and its exact command/testFiles selector are removed; its fake terminal refusal/liveness alarms are intentionally lost.  Earlier notes and dated/archived evidence retain original scopes.",
        "Complete prior commands before exact deleted selectors were pruned: [\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/terminal/input/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal/input/terminal-send-stale-leaf-liveness.test.ts --maxWorkers=2\",\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts --maxWorkers=2\",\"ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --maxWorkers=1\",\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\"ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts --maxWorkers=2\"]",
        "Complete prior testFiles before exact deleted selectors were pruned: [\"src/renderer/src/components/native-chat/prompts/NativeChatInteractiveCard.test.tsx\",\"src/renderer/src/components/native-chat/prompts/NativeChatResolvedView.prompt-card-input.test.tsx\",\"src/renderer/src/components/native-chat/surfaces/integration/NativeChatResolvedView.prompt-card-composer.test.tsx\",\"src/renderer/src/components/native-chat/conversation/turns/NativeChatResolvedView.turn-status.test.tsx\",\"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts\",\"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft.test.ts\",\"src/renderer/src/lib/agent-session/messaging/paste/agent-paste-draft-submit-retry.test.ts\",\"src/main/ipc/pty/ipc/write-input-user-input.test.ts\",\"src/main/ipc/pty/pty-write-ipc-validation.test.ts\",\"src/main/runtime/terminal/input/runtime-terminal-writer.test.ts\",\"src/main/runtime/rpc/terminal-send.test.ts\",\"src/main/runtime/terminal/input/terminal-send-stale-leaf-liveness.test.ts\",\"mobile/src/session/native-chat/input/mobile-prompt-controller.test.ts\",\"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\"]",
        "Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad mobile discovery loses whole prompt-presentation, Jira-URL and folder-source-repository suites. The prompt suite exercised presentation projections; it did not provide native mobile prompt acknowledgment acceptance. Existing direct prompt-controller selectors are unchanged. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The broad mobile command loses the entire three-case mocked diff-review controller suite and the stale layout-sequence comparator sample. Keep only the direct layout-versus-scrollback counter distinction; the unchanged dictation retry hook retains complete recording replay. No rendered app, native capture, actual process death or remote execution is claimed. All prior notes and archived receipts retain original scopes.",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The broad mobile runner loses retired-name sequencing and PR action samples while retaining the editor-lifetime and original PR action keeper; commit-message generation is unchanged. Earlier notes, complete dated receipts and archived gaps retain their original scopes."
      ],
      "promotionCriteria": [
        "Record change-reverted red/green evidence and repeatable remote rendered approval/question/dictation journeys.",
        "Collect physical provider/platform and CI soak evidence before promotion."
      ],
      "demotionRule": "Keep experimental until the missing evidence is collected; investigate failures without weakening occurrence, acknowledgment, cancellation or refusal assertions."
    },
    {
      "id": "agent-status.claude-task-wakeup-cycle",
      "title": "Claude task wake-ups cannot finish an automation before its lead turn",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-status",
      "layer": "execution-host-hooks-and-runtime-wait",
      "surfaces": [
        "canonical agent status",
        "terminal automation completion",
        "local and relayed cancellation"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1401 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: The reduced six-file selector passed 125 cases on Linux, exercising real HTTP hook ingress and the existing runtime automation observer. SSH/WSL ownership remains simulated; no physical remote-host, native macOS/Windows, task capacity or timer/resource-budget claim. Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts: Hand-built task notifications/cap inventories plus a manually assembled normalize/cache/expiry-timer host run under fake clocks with production lease constants and private state. No actual main/relay entry or provider delivery. Intentionally lose owed-task/Monitor/teammate/reset/notification expiry and cancellation-restatement alarms; no equivalent replacement claimed. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1401: src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts removed. Loses current-host proof, foreign/disposed/unsubscribed and legacy interrupt dispatch fence alarms. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/24878",
        "https://github.com/stablyai/orca/issues/23942"
      ],
      "invariant": "An ended tracked task stays pending until its wake-up and finishing turn end; missing wake-ups expire only after 60 idle seconds. Cancellation remains owned by the executing host, duplicate delivery cannot create a fresh completion veto, and fresh native rest can recover a lost finishing Stop.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1401 retired changed-source receipts. Historical oracle account: Replay captured hook ordering through production HTTP entry points and native ready bytes through the actual automation observer. Check local/relay state, cancellation/new-turn fencing, fresh versus retained rest, zero global status reads during indexed runtime waits.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1401 retired changed-source receipts; reduced selector has no new soak result. Historical account: The fresh reduced Linux fixture selector passed once; no CI soak history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1401 changed referenced test sources; no new red/green validation. Historical account: Identical corrected production automation test with actual Claude launch ownership prematurely completes on both parent main and the original PR; repaired candidate holds through task finishing. Same endpoint captures fail 12 of 18 parent tests. Indexed runtime counters fail before targeted reads and pass after."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1401 changed test sources; no new measurement. Previous account: Audit1297 removed direct task-map capacity and timer/publication count assertions. Indexed runtime read suites remain listed, but the reduced selector has no new run. No current task/timer resource-budget proof is claimed."
      },
      "knownGaps": [
        "Missing notifications intentionally postpone completion up to 60 idle seconds plus the existing runtime polling interval.",
        "Older remote hosts without optional phase/revision metadata retain their previous behavior.",
        "Physical SSH/WSL, native Windows/Linux, packaged Electron and an authenticated end-to-end Claude automation run are unverified.",
        "Audit1297: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-reordered-task-notification.test.ts removed. Lose unmatched/restored/foreign-session/end admission and delayed notification/end/launch/rearm ordering alarms. src/shared/agent-hook-listener/providers/claude-owed-notification-resource-contract.test.ts removed. Lose bounded pending notifications, obligation expiration/rearm and stale timer/lease cleanup alarms. No equivalent replacement coverage is claimed.",
        "Audit1297 retires this complete dated receipt because a source in its selector was removed. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-06\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/claude-owed-notification-resource-contract.test.ts src/shared/agent-hook-listener-claude-task-notification.test.ts src/shared/agent-hook-listener-claude-reordered-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/providers/claude-owed-notification-resource-contract.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-reordered-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.62,\n          \"summary\": \"Exact stored command with repository Vitest configuration passes 148 tests across eight files including out-of-order launch/end/delivery controls. Includes real HTTP/relay ingress, 12 blank/padded Agent/Bash/Monitor IDs, captured-native-rest automation completion, duplicate/cancellation controls, owner/phase gates, timer/task bounds and indexed reads. Three upstream interrupt suites pass 28 more tests separately. This dated receipt is unchanged; command now names the relocated test selector, not a new run. Original 2026-10-06 command: ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/claude-task-wakeup-indexed-read.test.ts src/shared/claude-owed-notification-resource-contract.test.ts src/shared/agent-hook-listener-claude-task-notification.test.ts src/shared/agent-hook-listener-claude-reordered-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\"\n        }",
        "Audit1297 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n    \"assertions\": [\n      \"does not reopen notification debt for a duplicate child-end post\",\n      \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n    \"assertions\": [\n      \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n    ]\n  }\n]",
        "Audit1300 reran the reduced six-file selector on Linux after audit1297 archived the complete former whole-selector receipt. Partial protection is restored only for the surviving assertion references; the retired task/timer bounds remain unprotected.",
        "Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts: Hand-built task notifications/cap inventories plus a manually assembled normalize/cache/expiry-timer host run under fake clocks with production lease constants and private state. No actual main/relay entry or provider delivery. Intentionally lose owed-task/Monitor/teammate/reset/notification expiry and cancellation-restatement alarms; no equivalent replacement claimed. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 11.23,\n          \"summary\": \"Test Files  6 passed (6); Tests  125 passed (125). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1401: src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts removed. Loses current-host proof, foreign/disposed/unsubscribed and legacy interrupt dispatch fence alarms. No equivalent replacement coverage is claimed.",
        "Audit1401 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n          \"durationSeconds\": 10.48,\n          \"summary\": \"Test Files  5 passed (5); Tests  108 passed (108). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"\n        }",
        "Audit1401 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"linux\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1401 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n    \"assertions\": [\n      \"does not reopen notification debt for a duplicate child-end post\",\n      \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n    \"assertions\": [\n      \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n    ]\n  }\n]",
        "Audit1401 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n          \"assertions\": [\n            \"does not reopen notification debt for a duplicate child-end post\",\n            \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n          \"assertions\": [\n            \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n          ]\n        }\n      ]",
        "Audit1401 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\"],\"testFiles\":[\"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\"src/main/runtime/tui-idle-claude-task-wakeup.test.ts\",\"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\"src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts\",\"src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\"]}"
      ],
      "promotionCriteria": [
        "Collect cross-platform and physical remote-host evidence plus the policy soak threshold without relaxing owner, phase, deadline or resource assertions."
      ],
      "demotionRule": "Remain experimental until platform and soak evidence; investigate failures without extending deadlines or accepting foreign/stale ownership."
    },
    {
      "id": "profile-storage.sqlite-authority-without-automatic-json",
      "title": "SQLite remains authoritative after automatic JSON snapshots are retired",
      "maturity": "experimental",
      "protection": "none",
      "owner": "persistence",
      "layer": "main-sqlite-lifecycle",
      "surfaces": [
        "shutdown and update checkpoints",
        "profile-switch maintenance",
        "offline profile recovery",
        "pinned and local build selection"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. NEXT136 retired affected callbacks and complete execution receipts. No equivalent fresh execution, provider/platform scope, soak or measured-budget credit is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/23262"],
      "invariant": "Ordinary lifecycle operations durably checkpoint SQLite without rewriting legacy JSON; missing SQLite cannot revive stale JSON; explicit recovery preserves artifacts and selects the named profile without changing active-profile state; the updater refuses JSON-era releases before admitting their feed.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. No current executed oracle remains after the authorized source-case and receipt retirements.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "knownGaps": [
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/startup/profile-state-recovery-preflight.test.ts: fails closed for malformed launch %j; carries the captured root, failing profile and approved repair sources unchanged; fails closed for malformed desktop launch %j. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Physical Windows/Linux installers, remote-host upgrades and packaged old-build downgrade not exercised locally.",
        "The offline conversion is explicit per profile; direct manual installation outside Orca cannot be intercepted.",
        "Test-value audit1327-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1327-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-10-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/startup/main-window-core-services.test.ts src/main/ipc/orca-profiles-switch-persistence.test.ts src/main/updater-sqlite-profile-downgrade.test.ts src/main/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/startup/main-window-core-services.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/updater/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 33.17,\n          \"summary\": \"1,435 tests passed with four skips across 145 passed test files and two skipped files. All three typecheck projects and the CLI build passed separately.\"\n        }",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-10-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/startup/main-window-core-services.test.ts src/main/ipc/orca-profiles-switch-persistence.test.ts src/main/updater-sqlite-profile-downgrade.test.ts src/main/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/startup/main-window-core-services.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/updater/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 33.17,\n          \"summary\": \"1,435 tests passed with four skips across 145 passed test files and two skipped files. All three typecheck projects and the CLI build passed separately.\"\n        }",
        "Audit1340: src/main/orca-profiles/profile-session-owner-transfer.test.ts removed. Ambiguous markdown owner override suppression. src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts reduced. Capacity code and permission/busy distinction across synthetic nested errors. No equivalent replacement coverage is claimed.",
        "Audit1340 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1348: src/main/persistence/loading-store/pty-incarnation-renderer-save.test.ts reduced. Merging another pane incarnation from a partially populated renderer map. No equivalent replacement coverage is claimed.",
        "Audit1348 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1366 deletes pty-binding-fast-lane.test.ts (five handcrafted predicate/diagnostic inventories) and removes two no-change/switch-off registrations from reused-terminal-id-unbind.test.ts. Those predicate-only and default-branch alarms are intentionally lost; remaining incarnation unbinding behavior is retained. Directory-selected prior unit receipts include these changed sources and are historical, not validation of the reduced set. The separate unchanged E2E receipt remains scoped to its own command. Fresh unit validation remains required.",
        "Historical receipt retired by audit1366 at 25cd81665e1b8eaf75d7715d37999ca1583e1228; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 /home/neil/.local/share/mise/installs/node/24.22.0/bin/node config/scripts/run-vitest.mjs run --config config/vitest.config.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/handlers/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/cli/specs/profile-state.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/orca-profiles src/main/persistence/loading-store src/main/persistence/profile-state src/main/startup/profile-state-recovery-preflight.test.ts src/main/updater/updater.build-channel-selection.test.ts src/shared/profile-state-build-compatibility.test.ts src/shared/profile-state-recovery-command.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/updater/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"durationSeconds\": 80.85,\n          \"summary\": \"Test Files  145 passed | 2 skipped (147); Tests  1588 passed | 30 skipped (1618). Complete primary unit selection on required Node24. Prior Node26 timeout failures preserved separately; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Historical receipt retired by audit1366 at 25cd81665e1b8eaf75d7715d37999ca1583e1228; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/handlers/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/cli/specs/profile-state.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/orca-profiles src/main/persistence/loading-store src/main/persistence/profile-state src/main/startup/profile-state-recovery-preflight.test.ts src/main/updater/updater.build-channel-selection.test.ts src/shared/profile-state-build-compatibility.test.ts src/shared/profile-state-recovery-command.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/updater/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n          \"durationSeconds\": 90.28,\n          \"summary\": \"Test Files  145 passed | 2 skipped (147); Tests  1588 passed | 30 skipped (1618). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit1371 removes the captureSource boolean invalidation replay from durable-settings-write.spec.ts. Actual SQLite acknowledgement, rollback, concurrent edit and optional-key restoration callbacks remain unchanged. Catalog-invalidation-only alarm is intentionally lost; no equivalent report-publication coverage is claimed. Directory-selected old unit receipts are historical; fresh validation remains required.",
        "Audit1383: src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts removed. Lose Japanese copy, copy/quit/ambiguity button payloads, selection index/confirmation and missing date formatting alarms. No equivalent replacement coverage is claimed.",
        "Audit1400: src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts reduced. Lose implementation-specific prior-tab read work bound; no behavior assertion lost beyond computed bulk replay. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/persistence/loading-store/store-prune-gate-signals.test.ts removed. Loses gate signals for release/removal and parked state for additive writes. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1412: src/main/persistence/loading-store/legacy-opencode-go-api-key-migration.test.ts reduced. Loses settings-field removal/no-decrypt parking, plaintext sealing/degraded parking, malformed-field rejection and repeated-run idempotency alarms. Kept failure recovery does not establish those exact paths. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1858 removes ordinary accepted JSON-era target examples from src/shared/profile-state-build-compatibility.test.ts. The JSON-era acceptance alarm is intentionally lost without equivalent replacement coverage. This helper remains in an optional broad unit selector with no active execution receipt; its focused survivor run does not validate the broad selector, physical downgrade/install behavior or other platforms/providers. The separate unchanged 2026-10-05 E2E receipt and historical records remain scoped to their own commands.",
        "Audit1891 removes checkpoint timer/write-count and selective-write/private-mode inventories, ordinary nested/getter-field persistence and export round trips, and the best-effort/strict final-getter example. Retained checkpoint callbacks cover actual stale-authority refusal, a queued-writer mutation reaching the final durable checkpoint, and frozen-profile durability; retained update/quit callback covers an injected final-commit failure preserving prior durable state without JSON publication. These optional reduced unit selectors have no new integrated execution result. Directory-selected prior unit receipts remain historical; the separate unchanged 2026-10-05 E2E receipt, all original knownGaps, commands, testFiles, assertionRefs and platform/provider/accounting fields retain their original scope. No equivalent replacement coverage is claimed.",
        "Audit1893 re-reviews imported persistence specs at current frozen bytes and intentionally removes42 authored definitions/71 static rows without equivalent replacement coverage: observer/domain-list inventories, matching-bind work and host/mode matrix, ordinary/memory-only rollback projections, branch-heavy created-surface title cases, synthetic restart retirement, mocked backup signal matrix, and4-phase x2-host queued-retirement/finalization matrix. Actual retained SQL/worker acknowledgement, ciphertext, cancellation, competing-writer, shutdown and partial-mutation refusal callbacks remain unchanged. Four durable-writes imports/describe calls for deleted specs are removed separately; the maintenance wrapper and its two active compatibility assertionRefs remain unchanged. Valid optional commands/testFiles remain, but reduced selectors await fresh integrated execution. The sole unchanged2026-10-05 macOS hidden-Electron E2E receipt and platform scope are preserved and do not execute these imported unit specs. Historical broad/reduced-unit receipts remain historical and verbatim. Focused wrapper execution cannot validate broad optional selectors, PTY delivery, physical SSH/mobile/WSL or other platforms.",
        "Audit1897 intentionally removes219 authored definitions/322 static rows across48 selected sources, including23 whole suites. The profile-state selector loses fixture/canonical equality and soak inventories, historical compatibility-acceptance metadata matrices, setup/default/bootstrap/migration inventories, backup-name/rotation branch inventories, raw-SQL child crash scripts that reimplement writes, private domain readers/equality/serialization, fragment-forgery matrices and parsed-snapshot plumbing. Removed command/error-message and injected access inventories are not replacement-validated. Retained independent SQL fencing, trigger rollback, production crash export/recovery and durable byte outcomes do not establish the lost alarms. Static totals use the macOS copy-boundary superset; no new native, WSL/SSH/mobile, rendered UI or cross-platform run is supplied. Exact accepted per-definition losses are recorded in sealed1897 reviews; all current selectors/assertionRefs and the unchanged2026-10-05 macOS E2E raw receipt remain. No equivalent replacement or fresh unit gate evidence is claimed.",
        "Audit1904 intentionally loses these direct profile-state source alarms: 'refuses rather than replaces something else at the backup path'; 'does nothing for an empty batch'; 'shares one process with absolute arguments and the per-file timeout budget'; 'bounds a shared process when many large artifacts are retained'; 'isolates %s/accepted=%s through corruption and WAL reopen'; 'bundles one process-host source graph into the isolated recovery fixture'; 'refuses readiness when a required worker artifact is absent'; 'refuses unknown and escaping IDs without falling back to the active profile'; 'rejects reused input before Store context installation (secret=%s)'; 'reads established storage once with retained JSON=%s'; 'consumes a parsed startup snapshot once, including an empty revision'; 'rejects initial state without its authority or alongside migration input'; 'keeps any other failed commit indeterminate even after SQLite rolled back'; 'joins an aborted writer without reporting a close request that was never sent'; 'keeps the SQLite failure behind a database open error across the writer boundary'; 'carries a real SQLite error code from a failed open'; 'keeps a cause-less open error cause-less'; 'refuses a versioned export with revision %s for an admitted revision of one'; 'refuses a revision jump at an unchanged-state fence'; 'refuses an initialization acknowledgement for a different revision'; 'leaves startup failure reporting to the startup caller'; 'does not report saving stopped after a recoverable request failure or clean close'; 'retries the first failure at once, then backs off up to a minute'; 'forgets the backoff once a reopen succeeds'; 'lets one attempt through a backoff for a final flush'; 'drops a pending bypass once a reopen succeeds'; 'permanently retires bootstrap authority and refuses subsequent calls'; 'aborts an active request without treating the pending write as rolled back'; 'resolves flat and shared-chunk entry layouts'. Retained production SQLite recovery, durable bytes, fencing and worker callbacks do not establish those exact lost alarms. Sources and accepted reasons are in sealed1904 reviews; no equivalent replacement or fresh integrated unit gate run is claimed.",
        "Audit1904 historical selected-profile assertion inventory; only unknown/escaping-ID refusal is removed from the active ref. The retained inactive-profile downgrade assertion remains valid. Complete original raw assertion object follows verbatim:\n{\n          \"file\": \"src/main/persistence/profile-state/profile-state-selected-profile-recovery.test.ts\",\n          \"assertions\": [\n            \"downgrades an inactive profile from its latest SQLite state without changing the active profile\",\n            \"refuses unknown and escaping IDs without falling back to the active profile\"\n          ]\n        }",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/updater/updater.build-channel-selection.test.ts. Unresolved local/computed edges remain explicit debt."
      ],
      "promotionCriteria": [
        "Collect cross-platform CI and crash-boundary soak evidence without weakening authority or durable-save assertions."
      ],
      "demotionRule": "Keep experimental until platform and soak evidence; investigate failures without extending waits or relaxing preservation/refusal assertions."
    },
    {
      "id": "terminal-preview.connection-settings-ownership",
      "title": "Terminal preview connections survive unrelated settings updates",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-unit",
      "surfaces": [
        "dashboard terminal preview connection",
        "preview settings updates",
        "preview box fit and grid claim"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Mounted production component and real settings action with cloned IPC replies, inert xterm/input adapters, and simulated metrics. Local/remote-qualified renderer identities covered; no physical provider, native geometry, focus, IME or rendered app claim. Subsequent hidden/offscreen Electron component proof uses real xterm and synthetic snapshots, preserving the rendered terminal across unrelated updates and measuring equivalent fallback scale/fit requests after a font-size change.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx",
        "https://github.com/stablyai/orca/pull/23099"
      ],
      "invariant": "Equal composed theme with unchanged PTY, mode, contrast and font/shaping settings keeps the current preview owner. Relevant changes replace it once, preserve explicit fit/grid negotiation, and reject retired pending completions.",
      "oracle": "Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Ten unrelated settings replies produce one connect and xterm construction, no pre-unmount teardown, then one final cleanup. Changed colors/mode/contrast/font/shaping replace owners; pending retired connections never construct and obsolete grid claims are canceled.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Focused deterministic suites; local elapsed recorded, p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local checks and independent adverse review only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Original reconnects/reconstructs11 times for10 unrelated updates; candidate1. Seven of14 lifetime cases fail original. Original and corrected candidate both pass all8 geometry preservation cases."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Ten unrelated settings replies: connect/constructor11 to1, pre-unmount unsubscribe/dispose10 to0. One previous-theme ref and shallow comparison added; CPU/heap overhead unmeasured. No timer/polling/subprocess/subscriber added; broad settings render/composition work remains."
      },
      "knownGaps": [
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "No full-dashboard interaction, native focus/input/IME, ligature shaping or physical PTY validation. Hidden Electron component rendering and one font-size transition were checked; fit endpoint was inert.",
        "No live SSH/WSL/relay or Linux/Windows run. Provider/wire ownership and folder/git workspace paths unchanged.",
        "Selection/buffer/input state now persists across unrelated and live cursor/scroll updates instead of incidental resets. Small comparison/ref overhead unmeasured.",
        "No CI soak, heap, main snapshot serialization or frame latency claim."
      ],
      "promotionCriteria": [
        "Retain count, stale-owner and explicit metric fit/grid oracles; add rendered native and provider/platform evidence plus CI soak."
      ],
      "demotionRule": "Keep experimental until soak; investigate failures without weakening owner counts, changed-theme behavior, fit/grid claims or late-disposal assertions."
    },
    {
      "id": "workspace-hooks.execution-host-ownership",
      "title": "Hook reads and writes use the stored repository execution owner",
      "maturity": "experimental",
      "protection": "none",
      "owner": "workspace-runtime",
      "layer": "cross-layer-unit",
      "surfaces": [
        "desktop worktree hook IPC",
        "runtime repository hooks",
        "issue-command read and write",
        "hosted-review own-store host resolution"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1412 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Actual hydration and authoritative desktop owner selection with mocked filesystem, Git, inspection and provider boundaries; synthetic local/SSH/runtime rows. No physical provider or native platform certification. Audit1412: src/main/ipc/hooks/worktree-hook-execution-host.test.ts reduced. Loses legacy/canonical/stale/runtime owner routing and folder no-local-hook-call alarms. The retained canonical SSH refusal does not establish other route selection. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts"
      ],
      "invariant": "Hook file operations follow the authoritative repository row in this process Store: canonical SSH selects its target, explicit local and self-addressed runtime rows use registered local files, and missing SSH providers never substitute local I/O.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1412 retired changed-source receipts. Historical oracle account: Nine desktop/runtime operations never use local I/O for canonical SSH or dial a stale legacy target; legacy SSH/local/runtime controls retain behavior, folder skips remain, missing providers do not gain local fallback.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1412 retired changed-source receipts; reduced selector has no new soak result. Historical account: Author and independent local evidence only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1412 changed referenced test sources; no new red/green validation. Historical account: Frozen permanent suite68pass; original sources37fail31controls; independently reproduced with eleven extra controls."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1412 changed test sources; no new measurement. Previous account: Incorrect local/stale-target routes9to0 for each of four changed identity shapes. This is correctness evidence only, no latency/CPU/heap gain. Existing host resolver reused, no polling, cache or inventory/subprocess fanout added."
      },
      "knownGaps": [
        "CI soak pending.",
        "Physical SSH/WSL/remote-runtime, native Linux/Windows, mobile and mixed-version integration untested. Local/daemon PTY data, identity and liveness unchanged.",
        "Runtime absent-provider issue-command write still returns ok:true without a write; this preexisting convention is not a completion claim.",
        "Only own-store rows use the generalized helper; generic runtime dispatch still rejects hosts this process does not execute.",
        "No actual filesystem writes, provider operations, native UI or packaged app validation in routing fixtures.",
        "Audit1412: src/main/ipc/hooks/worktree-hook-execution-host.test.ts reduced. Loses legacy/canonical/stale/runtime owner routing and folder no-local-hook-call alarms. The retained canonical SSH refusal does not establish other route selection. No equivalent replacement coverage is claimed.",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-26\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.739,\n          \"summary\": \"Independent68pass/original37fail31controls. Eleven additional authority/unavailable-provider/encoded-ID/folder controls pass; author102unique permanent tests across four suites.\"\n        }",
        "Audit1412 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1412 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/ipc/hooks/worktree-hook-execution-host.test.ts\",\n    \"assertions\": [\n      \"routes %s to the stored owner\",\n      \"refuses an unreachable canonical SSH write without touching local files\"\n    ]\n  }\n]",
        "Audit1412 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/ipc/hooks/worktree-hook-execution-host.test.ts\",\n          \"assertions\": [\n            \"routes %s to the stored owner\",\n            \"refuses an unreachable canonical SSH write without touching local files\"\n          ]\n        }\n      ]",
        "Audit1412 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts\"],\"testFiles\":[\"src/main/ipc/hooks/worktree-hook-execution-host.test.ts\"]}"
      ],
      "promotionCriteria": [
        "Retain exact route, no-local-fallback and authority oracles; obtain CI soak and physical host evidence before promotion."
      ],
      "demotionRule": "Keep experimental until soak; investigate authority/routing failures without replacing exact-target or no-local-I/O assertions."
    },
    {
      "id": "runtime-files.renderer-document-watch-ownership",
      "title": "Filesystem watches stay owned by their renderer document",
      "maturity": "experimental",
      "protection": "none",
      "owner": "runtime-platform",
      "layer": "ipc-contract",
      "surfaces": ["desktop file explorer watchers", "desktop editor file watchers"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Actual desktop local/WSL subscription logic under mocked filesystem handles on macOS. Document events use an EventEmitter sender. Native Windows/Linux/WSL and rendered reload reattachment are unproved; PTY/process liveness and wire formats are unaffected. SSH roots have no desktop watcher. Audit1400: src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts reduced. Lose long reload-loop repetition; cleanup and listener lifetime remain exercised in retained cases. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/ipc/filesystem/watchers/filesystem-watcher-listener-lifecycle.ts"
      ],
      "invariant": "A replaced or crashed renderer document retains no file watches or pending ownership and cannot recreate them from an old asynchronous continuation. Shared roots retain live sibling owners; blocked and same-document navigation retain the current document. Shutdown removes registered lifecycle listeners.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Run repeated reloads/crash, pending installation cancellation with late success, aborted-install joiners, failed-removal restoration and shutdown/reopen. Require zero obsolete roots/listeners, no stale setup, physical handle disposal and preservation of sibling notifications.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: Local validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: Seven permanent regressions failed with HEAD source substituted when this gate landed: cancelled joiner resurrection, restoration into replaced documents, stale retry, shutdown listener retention and root retention. The SSH cases went with the dead SSH watcher; the local cases remain."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: 15 reloads plus crash: retained local roots 16→0; pending setup aborted; sender lifecycle listeners 1→0. Actual ownership modules with synthetic handles; no native process/heap/latency claim. No new timer, polling, process scan or provider fanout; existing root cleanup runs at document end."
      },
      "knownGaps": [
        "No native Windows/Linux/WSL execution.",
        "No rendered Electron reload-reattachment/paint run or CI soak; broader watcher process isolation is a separate gate.",
        "Audit1400: src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts reduced. Lose long reload-loop repetition; cleanup and listener lifetime remain exercised in retained cases. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.99,\n          \"summary\": \"33 tests across three focused suites pass after the dead SSH watcher was removed.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts --reporter=dot\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts\",\n    \"assertions\": [\n      \"retains zero roots and listeners across 15 reloads and a renderer crash\",\n      \"does not revive a cancelled setup for a joiner whose document reloaded\",\n      \"does not restore a replaced sibling document after an awaited removal recovery\",\n      \"keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts\",\n          \"assertions\": [\n            \"retains zero roots and listeners across 15 reloads and a renderer crash\",\n            \"does not revive a cancelled setup for a joiner whose document reloaded\",\n            \"does not restore a replaced sibling document after an awaited removal recovery\",\n            \"keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts --reporter=dot\"],\"testFiles\":[\"src/main/ipc/filesystem/watchers/filesystem-watcher-document-lifetime.test.ts\",\"src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts\",\"src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts\"]}"
      ],
      "promotionCriteria": [
        "Retain lifecycle, count and sibling-delivery assertions and add cross-platform and rendered reload evidence before promotion."
      ],
      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without suppressing assertions or retrying unexplained failures."
    },
    {
      "id": "ephemeral-vm-recipe.output-tail-parity",
      "title": "Recipe output capture preserves UTF-8 tails and releases settled storage",
      "maturity": "experimental",
      "protection": "none",
      "owner": "ephemeral-vm-runtime-store",
      "layer": "shared-node-process-contract",
      "surfaces": ["VM recipe stdout and stderr", "recipe cancellation and process errors"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Actual recipe capture with synthetic child streams and real forced GC, plus real macOS shell output and descendant cancellation. Linux and Windows native execution, live VM providers and remote lifecycle journeys remain untested. Local/daemon PTY, SSH ownership, WSL launch, mobile and relay wire behavior are unaffected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/01ce5edf1aeec8a4b5cf06f531434be7d7c0cbcd/src/shared/ephemeral-vm-recipe-process.ts"
      ],
      "invariant": "Decoded stdout and stderr callback contents and order remain unchanged, final tails are the last capped run of raw output bytes with any leading partial UTF-8 sequence dropped, and success or failure releases capture storage without recapturing late output.",
      "oracle": "Compare byte-bounded tails against the old per-chunk model and an independent code-point model across compaction, growth, oversized chunks and mid-character splits. Feed split and malformed UTF-8 through actual stream decoding. Require at most 5 MiB moved through the capture for 4 MiB of output with zero encoding, collectible backing buffers after close and error, zero late capture work with preserved callbacks, one decode per stream, unchanged tails on forced cancellation or synchronous kill-close, and every capture limit clamped to a bounded byte count.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "focused Node process and capture contracts with forced GC"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Author and independent local runs pass; no CI or soak history collected."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Baseline moves 943,194,112 bytes for 4 MiB output and fails the permanent 5 MiB budget. An earlier ring prototype retained two backing buffers after error and encoded late output after close; both permanent lifetime cases fail there and pass after cleanup correction. Dropping the head offset from GrowingByteBuffer keeps the byte budget but takes 12.36 ms instead of 0.25 ms."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "4 MiB in 4 KiB chunks, seven paired samples, macOS: the old per-chunk re-encode moves 943,194,112 bytes in 265.78 ms median; raw-byte capture into GrowingByteBuffer moves 4,194,304 appended plus 1,048,576 decoded bytes, encodes nothing, and takes 0.25 ms. End to end through runRecipeCommand is 0.26 ms with no output callback and 0.78 ms with one (the callback decoder is the work setEncoding already did). A 64-byte one-shot is 0.075 to 0.206 microseconds; retained storage reserves spare capacity and can exceed a string. No new polling, timers, subprocesses, wire fields or deadline changes."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Exercise native Windows and Linux recipe output and cancellation."
      ],
      "knownGaps": [
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Synthetic output timings do not establish typical recipe prevalence, end-to-end provisioning gains or UI latency.",
        "Retained storage reserves spare capacity and can use more memory than a string; CJK bytes can exceed UTF-16 storage. Tiny output is slower, and an oversized single chunk still copies its capped tail.",
        "Malformed UTF-8 now yields a different tail than the old policy: replacement characters no longer inflate the byte count, so a malformed tail keeps more real output. No production override of the cap was found, and odd caps are clamped rather than coerced per chunk.",
        "Live VM providers, SSH lifecycle journeys, and native Windows or Linux termination were not run."
      ],
      "demotionRule": "Keep experimental or demote if output differs, discarded bytes return, settled capture remains reachable, cancellation loses its tail, or the deterministic encoding budget regresses. Never weaken the oracle or increase retries to obtain a pass."
    },
    {
      "id": "agent-session.spawn-workspace-trust",
      "title": "Agent PTY spawns wait for a bounded workspace trust write",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "cross-layer-unit",
      "surfaces": [
        "renderer PTY spawn builder",
        "runtime PTY spawn builder",
        "structured Codex chat create intent",
        "agent workspace trust dispatcher",
        "execution-host workspace trust writer (main and SSH relay)",
        "SSH relay agent workspace trust"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: The retained local dispatcher tests check bounded Codex and Claude waits and a real Claude config file. The execution-host suite checks actual trust artifacts, exact Codex keys, home/root/symlink rejection and unknown-home refusal. The listed spawn-builder and structured-chat suites remain separate evidence; this audit did not revalidate them. Mock-only spawn-hook routing and dispatcher provider/SSH/WSL tables were removed during the test-value audit. No native PTY, live SSH host or WSL guest was exercised.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/agent-launch/trust/agent-workspace-trust.ts"
      ],
      "invariant": "A fresh PTY launch of an agent with a trust preset pre-trusts its workspace root (for Codex, whose lookup keys on its start folder, the folder it starts in, including a floating terminal's) before the provider spawn, in both spawn builders, on the host that runs the agent: main for local and WSL launches, the SSH relay on its own disk for SSH launches. It never waits past the preset's deadline: 20 s for local Codex, the short budget for every other write, local or on the relay. A failed or abandoned write lets the launch proceed untrusted, so the agent asks. Restored or reattached panes, spawns with no launch command and the setting turned off are never trusted; for an agent whose trust on a home covers the folders below it (Claude, Copilot, Qoder), no writer stores a path that is a root, a home or a folder above one, and an unknown home writes nothing; Codex, Cursor and Antigravity, whose trust on a home covers only the home, trust it as they did before; and a WSL launch never writes the Windows home. A structured Codex chat, which has no PTY, pre-trusts its folder the same way when it is created, under the same setting.",
      "oracle": "A pending local Codex write keeps the dispatcher unresolved past the short budget and settles after the long deadline. A pending Claude write settles at the short deadline with a warning, and a real Claude grant writes the config selected by the launch environment. Actual host-writer artifacts establish ordinary-folder admission and home/root/ancestor/symlink/missing-segment refusal, including an unknown home, with exact Codex worktree, subfolder and home keys. Other retained assertions are named in assertionRefs; removed mock-routing assertions provide no current protection.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Focused spawn-builder, dispatcher deadline, execution-host writer and structured-intent suites; p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local mocked evidence only; CI soak pending."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Each named case failed with its fix removed and passed restored: the builder's await turned into a fire-and-forget call fails the hold case; guarding every preset fails each Codex, Cursor and Antigravity home case, and guarding none fails each Claude, Copilot and Qoder home, root, symlink and `..` case; dropping the unknown-home rule fails every no-home case; the relay deriving only Claude from launchAgent fails each non-Claude relay case; the dispatcher handing only Claude to the relay fails each SSH preset case; dropping the relay's Antigravity return fails its case; letting the host writer's catch rethrow fails every guard-failure case; dropping resolve() from the guard's forms fails the missing `..` path case for every guarded preset; marking Codex as trusted at the workspace root, or a builder dropping the start folder, fails the Codex floating-terminal and subfolder cases; removing the relay handler's trust call, or not awaiting it, fails the relay handler case; removing the structured Codex create intent's trust call fails its pre-trust case, and dropping its setting check fails its setting-off case. The 2026-11-03 test-value audit removed the mock-only routing, inventory and injected-error cases; their historical mutations no longer demonstrate current coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Plain shells and agents without a preset add no trust I/O; the hook returns after the preset check. A local Codex write is capped at 20 s and every other write, local or on the relay, at the short budget, each by one timer cleared on settlement. An SSH launch adds no round trip: the field rides the existing pty.spawn request. The deadline bounds the wait, not the write: an abandoned write still lands later. The local Claude writer reads and parses Claude's config synchronously on the main thread before its lock."
      },
      "knownGaps": [
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "CI soak pending.",
        "No live agent CLI, PTY, trust prompt, native Electron app, SSH host or WSL guest was exercised.",
        "Abandoning a write at the deadline does not cancel it; a slow write can land after the agent already asked.",
        "The deadline values are reasoned caps, not measured p95s.",
        "Antigravity over SSH is not written on the relay (its writer is unverified there), so it still asks.",
        "The 2026-11-03 audit removed mock-only spawn-hook and dispatcher routing assertions, including injected guard-failure handling. Those deletions intentionally reduce alarms; this gate does not claim replacement coverage for those specific cases."
      ],
      "promotionCriteria": [
        "Retain the hold, deadline and home or root red/green evidence; obtain native platform and SSH evidence and a CI soak before promotion."
      ],
      "demotionRule": "Remain experimental until repeated independent or CI evidence; investigate ordering or unbounded-wait regressions without weakening the hold or deadline assertions."
    },

    {
      "id": "settings.accounts-section-lifetime",
      "title": "Accounts search preserves matching account section owners",
      "maturity": "experimental",
      "protection": "none",
      "owner": "renderer-settings",
      "layer": "renderer-unit",
      "surfaces": [
        "Accounts settings search",
        "Grok and Cursor account status",
        "Codex pending sign-in link"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1437 removes AccountsPane.section-lifetime.test.tsx: DOM identity, mock status/read/subscription counts and simulated platform variants are intentionally retired. No equivalent replacement coverage is claimed. Historical coverage account: Actual AccountsPane, Grok, Cursor and Codex login components; synthetic APIs/store with Windows account support enabled/disabled. No real account, keychain or provider action.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/accounts/AccountsPane.tsx"
      ],
      "invariant": "Matching sections retain their owners as earlier search results disappear; genuine removal releases the Codex subscription and reopens fresh status reads.",
      "oracle": "No current automated oracle is claimed after Audit1437 removed this suite. Historical oracle account: Across nine matching Grok, ten matching Cursor and eleven matching Codex queries each matched section keeps the same DOM node and its status-read, watcher and subscription counts do not grow, against four to six reads each before. Explicit refresh, store-published usage updates, pushed login URLs and genuine removal all still reach the retained section.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Focused renderer-unit suites, p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "No current suite remains. Historical account: Author and independent local evidence only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Historical red/green only after suite removal. Candidate ten pass; current-main original seven fail and three controls pass."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Actual renderer status-read/subscription admissions counted; the section map now lives in the shared SettingsSectionStack and no cache, poll, listener or process is added. No CPU, latency or heap claim. Matching sections retain local state and lose only the incidental search-driven refresh that duplicated an existing subscription."
      },
      "knownGaps": [
        "CI soak pending.",
        "No native Linux/Windows or live SSH/WSL/paired provider behavior; platform flags are simulated.",
        "Hidden Electron Grok proof uses the original audit baseline and synthetic status; current-main Cursor addition has unit evidence only.",
        "Matching search no longer incidentally refreshes Grok/Cursor status or pending Codex URLs. Every one of those surfaces is store-subscribed or push-subscribed, so the retained section still tracks usage updates, pushed login URLs, explicit refresh and true hide/reopen; there is no bounded automatic freshness deadline and none of them relied on one before.",
        "Child drafts, errors, copied feedback and timers remain until their own transition or real removal.",
        "Audit1437 removes AccountsPane.section-lifetime.test.tsx: DOM identity, mock status/read/subscription counts and simulated platform variants are intentionally retired. No equivalent replacement coverage is claimed. Original complete gate record: {\"id\":\"settings.accounts-section-lifetime\",\"title\":\"Accounts search preserves matching account section owners\",\"maturity\":\"experimental\",\"protection\":\"partial\",\"owner\":\"renderer-settings\",\"layer\":\"renderer-unit\",\"surfaces\":[\"Accounts settings search\",\"Grok and Cursor account status\",\"Codex pending sign-in link\"],\"platforms\":[\"macos\",\"linux\",\"windows\"],\"providers\":[\"local\",\"remote-runtime\",\"ssh\",\"wsl\"],\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[],\"coverageNotes\":\"Actual AccountsPane, Grok, Cursor and Codex login components; synthetic APIs/store with Windows account support enabled/disabled. No real account, keychain or provider action.\",\"motivatingLinks\":[\"https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/accounts/AccountsPane.tsx\"],\"invariant\":\"Matching sections retain their owners as earlier search results disappear; genuine removal releases the Codex subscription and reopens fresh status reads.\",\"oracle\":\"Across nine matching Grok, ten matching Cursor and eleven matching Codex queries each matched section keeps the same DOM node and its status-read, watcher and subscription counts do not grow, against four to six reads each before. Explicit refresh, store-published usage updates, pushed login URLs and genuine removal all still reach the retained section.\",\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/accounts/AccountsPane.section-lifetime.test.tsx\"],\"testFiles\":[\"src/renderer/src/components/settings/accounts/AccountsPane.section-lifetime.test.tsx\"],\"assertionRefs\":[{\"file\":\"src/renderer/src/components/settings/accounts/AccountsPane.section-lifetime.test.tsx\",\"assertions\":[\"preserves explicit Grok refresh and real hide/reopen status reads\",\"keeps the login subscription until Codex genuinely hides\",\"keeps Cursor refresh driven by usage updates and genuine reopen\"]}],\"evidenceRuns\":[{\"date\":\"2026-09-26\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/accounts/AccountsPane.section-lifetime.test.tsx\",\"result\":\"passed\",\"durationSeconds\":1.84,\"summary\":\"10 tests/1 suite pass after the shared SettingsSectionStack adoption. Read-count oracles restated as node identity plus non-growing counts; original main fails the three retained-section cases and the retained Codex subscription, and passes the explicit-refresh, usage-driven and genuine-removal controls.\"}],\"runtimeBudget\":{\"p95Seconds\":10,\"scope\":\"Focused renderer-unit suites, p95 not established.\"},\"flakeHistory\":{\"status\":\"not-started\",\"evidence\":\"Author and independent local evidence only; no CI soak.\"},\"redGreenEvidence\":{\"status\":\"complete\",\"evidence\":\"Candidate ten pass; current-main original seven fail and three controls pass.\"},\"performanceBudget\":{\"required\":true,\"evidence\":\"Actual renderer status-read/subscription admissions counted; the section map now lives in the shared SettingsSectionStack and no cache, poll, listener or process is added. No CPU, latency or heap claim. Matching sections retain local state and lose only the incidental search-driven refresh that duplicated an existing subscription.\"},\"knownGaps\":[\"CI soak pending.\",\"No native Linux/Windows or live SSH/WSL/paired provider behavior; platform flags are simulated.\",\"Hidden Electron Grok proof uses the original audit baseline and synthetic status; current-main Cursor addition has unit evidence only.\",\"Matching search no longer incidentally refreshes Grok/Cursor status or pending Codex URLs. Every one of those surfaces is store-subscribed or push-subscribed, so the retained section still tracks usage updates, pushed login URLs, explicit refresh and true hide/reopen; there is no bounded automatic freshness deadline and none of them relied on one before.\",\"Child drafts, errors, copied feedback and timers remain until their own transition or real removal.\"],\"promotionCriteria\":[\"Retain read/subscription counts and genuine-removal controls; collect CI soak and relevant full-app provider evidence.\"],\"demotionRule\":\"Keep experimental until soak; investigate owner and refresh regressions without weakening assertions or adding retries.\"}"
      ],
      "promotionCriteria": [
        "Retain read/subscription counts and genuine-removal controls; collect CI soak and relevant full-app provider evidence."
      ],
      "demotionRule": "Keep experimental until soak; investigate owner and refresh regressions without weakening assertions or adding retries."
    },
    {
      "id": "settings.terminal-section-lifetime",
      "title": "Terminal settings search preserves matching section state",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-unit",
      "surfaces": [
        "Terminal settings search",
        "session diagnostic inventory",
        "scrollback settings draft"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Module-layout wave1 retires the terminal-section lifetime owning suite and its complete dated receipt. The remaining TCC attribution notice suite does not establish the search-lifetime invariant. No current protection, replacement coverage, native/provider execution or fresh evidence is claimed. Historical scope before retirement: Actual TerminalPane, ManageSessionsSection, health listener and scrollback form with mocked store/provider and display/action boundaries. Unix/Windows and Mac-client/Windows-host flags simulated; no physical provider, process-stop or native input coverage.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/terminal/TerminalPane.tsx"
      ],
      "invariant": "A matching settings section retains its state when preceding sections are filtered away; a section removed from search releases its owner and refreshes when shown again. A retained section still refreshes when another surface invalidates the session inventory. Diagnostic inventory never becomes authority for process death.",
      "oracle": "Target oracle, currently unprotected after whole-suite retirement: Across 15 matched search edits the matched section keeps the same DOM node and the inventory/health read counts do not grow, instead of six reads each. A foreign inventory invalidation still reads once on the retained section and not after unmount. A draft and pending target survive matched search; actual hide/reopen reloads, explicit Refresh still reads, and hidden/unmounted health listeners do not fire.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Focused renderer-unit suites, p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "No current search-lifetime suite or soak evidence remains. Historical statement before retirement: Author and independent local evidence only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "The owning search-lifetime suite was retired whole. Its historical red/green result does not validate the remaining unrelated TCC attribution notice suite."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget account only; no current selector or fresh performance measurement: Actual child inventory and health reads 6 to 1 across 15 matched search edits. Fixed small section filter/map now lives in the shared SettingsSectionStack; no new polling, cache or subprocess. One added in-renderer invalidation listener replaces the incidental search-driven refresh, so a retained section stays as fresh as the signal every other inventory reader already uses. No packaged CPU/frame/heap claim."
      },
      "knownGaps": [
        "CI soak pending.",
        "No physical local/daemon/SSH/WSL/remote-runtime provider, native Linux/Windows or process-stop behavior exercised; routing, PTY ownership, commands and wire formats unchanged.",
        "Matched searches keep the loaded snapshot until existing Refresh, completed mutation, a foreign inventory invalidation or genuine hide/reopen; health also refreshes on focus/revision.",
        "Pending action target and drafts remain while their parent section matches, including individual controls hidden inside a retained section.",
        "No packaged app latency, heap, real focus or pending destructive-mutation completion evidence. Hidden Electron component visual proof is separate from the gate.",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/components/settings/terminal/TerminalPane.section-lifetime.test.tsx. Lost alarms: refreshes a retained section when another surface invalidates the inventory; refreshes explicitly, reloads genuinely hidden sections, and removes focus listeners; preserves an uncommitted scrollback draft while its section remains visible; retains a pending action target only while its section remains visible. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope.",
        "Module-layout wave1 retires this complete historical receipt because its explicit current selector was reduced. It does not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-09-26\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/TerminalPane.section-lifetime.test.tsx src/renderer/src/components/settings/TerminalTccAttributionNotice.test.tsx\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/terminal/TerminalPane.section-lifetime.test.tsx src/renderer/src/components/settings/developer-permissions/TerminalTccAttributionNotice.test.tsx\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.48,\n          \"summary\": \"12 tests/2 suites pass after the shared SettingsSectionStack adoption and the inventory-invalidation subscription. Read-count oracles restated as node identity plus non-growing read counts; original main fails all three simulated platform cases, the draft, the pending target and the foreign-invalidation refresh.\"\n        }",
        "Module-layout wave1 historical red/green statement before owning-suite retirement, retained verbatim without current validation credit: {\"status\":\"complete\",\"evidence\":\"Original new suite fails all three simulated platform read-count cases, draft and pending target; one cleanup/refresh control passes. Candidate6pass. Independent scratch5pass/original4fail1control.\"}"
      ],
      "promotionCriteria": [
        "Retain count, real draft, pending target and cleanup oracles; obtain stable CI history and relevant full-app/provider evidence before promotion."
      ],
      "demotionRule": "Keep experimental until soak; investigate stale state or cleanup failures without weakening read-count, draft or fresh-owner assertions."
    },
    {
      "id": "agent-session.journal-streaming-replay",
      "title": "Journal replay bounds obsolete revision memory without changing recovery",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "runtime-unit",
      "surfaces": ["structured chat journal replay", "structured chat damaged history"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1650 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Production SQLite and reducer tests on macOS. Execution-host-local storage behavior is shared by remote runtimes; no live SSH or Windows/Linux run. PTY, daemon, WSL process launch, transport framing and mobile rendering are unaffected. Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts: Keep actual SQLite replay classification of future versions, first sequence damage and missing epoch against independent literal state/damage expectations. Remove GC/heap thresholds and private reducer-call counters plus same-connection PASSIVE checkpoint busy checks, which do not demonstrate an independently blocked checkpoint. Lose assembled replay memory/snapshot scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1371 removes synthetic receipt callback choreography and single/batch timestamp comparison from journal-row-writer.spec.ts. Actual SQLite duplicate-insert rollback/reuse and batch atomicity callbacks remain unchanged. The old directory-selected receipt is historical and does not validate this reduced selector. No equivalent replacement claim. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed. Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1390: src/main/native-chat/agent-session-journal/journal-submission-positions.spec.ts reduced. Standalone history-page submitted-sequence projection alarm removed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1392: src/main/native-chat/agent-session-journal/journal-payload-bounds-retention.test.ts reduced. Retires hand-copied UTF-8 clipping implementation comparison loops and deterministic random differential replay. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/native-chat/agent-session-journal/command-receipt-schema.spec.ts reduced. Fresh receipt schema physical layout no longer independently enumerated. src/main/native-chat/agent-session-journal/journal-unsent-send-hold-queue.spec.ts reduced. Source-present versus source-absent folded property shape loses one separate assertion. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts removed. Loses oversized atomic-settlement rollback and replay/idempotence alarms. src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1739 removes 53 of 118 authored journal/wire definitions, including 11 entire files and four driver registrar imports. Lost alarms include projection/schema tables, cursor helper branches, weak stale-liveness properties, standalone first-damage/missing-epoch diagnostics and narrow persistence copies. Retained callbacks are unchanged; this removal is not equivalent replacement coverage. Focused candidate execution is recorded separately and does not establish performance, red/green, CI soak, live providers, remote execution or cross-platform coverage.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/native-chat/agent-session-journal/journal-open.ts"
      ],
      "invariant": "Replay preserves latest revisions, original item order, fences, aliases, submissions, a newer schema winning over damage and cursor cleanup while retaining live items rather than all historical bodies; damage fails the load and deletes nothing.",
      "oracle": "Retained replay case identifies a future row beyond a gap while preserving the literal folded prefix. Separate damaged-history cases check refused opens preserve physical rows and invalid epoch replacement rolls back. Standalone first-damage and missing-epoch diagnostic examples were removed; no equivalent replacement, memory bound or independently blocked cursor oracle is claimed.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Unit fixtures; p95 not established. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local candidate validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Production-function AB/BA benchmark samples 132.6 MB live heap in baseline vs 88-92 KB with streaming on a 66.7 MB revision-heavy journal. The retained-heap unit test fails against the original code and passes with streaming; value and cursor assertions pass in both implementations."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Paged SQLite reads (one completed statement per page) and immediate reduction retain reduced state plus one page of rows. No cursor or read snapshot outlives its statement, so a WAL checkpoint can pass mid-replay; no new polling, subprocess, provider call or wire change."
      },
      "knownGaps": [
        "Audit1739 removes 53 of 118 authored journal/wire definitions, including 11 entire files and four driver registrar imports. Lost alarms include projection/schema tables, cursor helper branches, weak stale-liveness properties, standalone first-damage/missing-epoch diagnostics and narrow persistence copies. Retained callbacks are unchanged; this removal is not equivalent replacement coverage. Focused candidate execution is recorded separately and does not establish performance, red/green, CI soak, live providers, remote execution or cross-platform coverage.",
        "Audit1650 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No Windows/Linux runtime execution or real remote-host validation.",
        "Latest live message bodies still require memory proportional to their total size; this removes superseded-history retention, not live-history storage.",
        "Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-09-11\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts\",\"result\":\"passed\",\"durationSeconds\":7.71,\"summary\":\"245 tests passed across 22 files. Retained-heap oracle fails on baseline at 68.6 MB and passes under 8 MiB with streaming; gap/schema and cursor-cleanup assertions passed.\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\"}",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-10-02\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\"result\":\"passed\",\"durationSeconds\":5.56,\"summary\":\"450 tests passed across 42 files, run as the vitest invocation the test script makes. Damage fails the load with every row kept; the retained-heap, newer-row-past-a-gap and cursor-cleanup assertions passed.\"}",
        "Audit1302: src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts: Keep actual SQLite replay classification of future versions, first sequence damage and missing epoch against independent literal state/damage expectations. Remove GC/heap thresholds and private reducer-call counters plus same-connection PASSIVE checkpoint busy checks, which do not demonstrate an independently blocked checkpoint. Lose assembled replay memory/snapshot scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\"result\":\"passed\",\"durationSeconds\":38.85,\"summary\":\"Test Files  51 passed (51); Tests  689 passed (689). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1324 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\"durationSeconds\":43.39,\"summary\":\"Test Files  48 passed (48); Tests  673 passed (673). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 574edb34b8e5448541e7a69aac098958d91ffb06.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\"durationSeconds\":34.68,\"summary\":\"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 49e2978f83d521bd487e52e0b8b21a1902834caf.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\"durationSeconds\":40.08,\"summary\":\"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 4fa83106fcdb5ffd53ad527bf59f83b72aec2285.\"}",
        "Test-value audit1327-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1327-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\n          \"durationSeconds\": 35.48,\n          \"summary\": \"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\n          \"durationSeconds\": 35.48,\n          \"summary\": \"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Audit1371 removes synthetic receipt callback choreography and single/batch timestamp comparison from journal-row-writer.spec.ts. Actual SQLite duplicate-insert rollback/reuse and batch atomicity callbacks remain unchanged. The old directory-selected receipt is historical and does not validate this reduced selector. No equivalent replacement claim.",
        "Historical receipt retired by audit1372 at 1f0e6b60b1cb31fc3aebaf573da5957297c8c613; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts\",\n          \"durationSeconds\": 53.43,\n          \"summary\": \"Test Files  50 passed (50); Tests  717 passed (717). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"\n        }",
        "Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1390: src/main/native-chat/agent-session-journal/journal-submission-positions.spec.ts reduced. Standalone history-page submitted-sequence projection alarm removed. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1392: src/main/native-chat/agent-session-journal/journal-payload-bounds-retention.test.ts reduced. Retires hand-copied UTF-8 clipping implementation comparison loops and deterministic random differential replay. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1396: src/main/native-chat/agent-session-journal/command-receipt-schema.spec.ts reduced. Fresh receipt schema physical layout no longer independently enumerated. src/main/native-chat/agent-session-journal/journal-unsent-send-hold-queue.spec.ts reduced. Source-present versus source-absent folded property shape loses one separate assertion. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts removed. Loses oversized atomic-settlement rollback and replay/idempotence alarms. src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged."
      ],
      "promotionCriteria": ["Retain red/green heap and value assertions and complete CI soak."],
      "demotionRule": "Keep experimental until cross-platform and soak evidence; investigate failures without weakening content or memory assertions."
    },
    {
      "id": "runtime.connection-owned-host-status",
      "title": "Host status recovers with its owning connection",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime",
      "layer": "service-integration-and-e2e",
      "surfaces": [
        "sidebar host status",
        "desktop runtime connection",
        "browser primary connection"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit 3301 removes the failed-verification/recovery/restart generation and host-contact-epoch, hosting and no-toast example from runtime-status-snapshot.test.ts. Earlier prose describing that example as retained is historical. Disconnect/pairing retirement and delayed catalog replay remain unchanged without equivalent replacement. Archive both complete historical 22-case unit receipts because their selector includes the reduced source; preserve the unrelated rendered receipt, current selectors and other-owner assertion references. No fresh aggregate or live host validation is claimed. Linux coverage from those two unit runs is historical; current covered-platform scope is limited to the preserved macOS rendered receipt. Audit1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Real authenticated sockets plus isolated desktop and headless hosts with desktop and browser viewers; deterministic lifecycle tests cover stale results and reader deadlines. The test-value audit removes the standalone runtime-status-snapshot.test.ts example that immediately applied the same supplied snapshots to two isolated slice stores. Its direct sequence-2 then older unavailable sequence-1 acceptance/rejection alarm is intentionally lost; it did not exercise a pending read, subscription delivery or a shared viewer connection. The suite retains failed-verification/recovery, disconnect/pairing retirement and catalog-refresh replay examples, which are not equivalent replacements. Historical executed commands, counts and results remain unchanged; no new live host, process restart or platform evidence is claimed. Audit1348: src/main/ipc/runtime-environments/runtime-environment-status-recovery.test.ts removed. Startup retry/broadcast counts and passive-before-active bootstrap request count. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. The current assertion index names unchanged owner lifecycle tests from the successful focused run. They do not replace the deleted startup retry/broadcast count alarms. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1748 removes7 of13 authored host-status-owner definitions: request/polling counts, reconnect/no-request variants, deadline copy and blocked-reason projections. Lost alarms are intentional; no equivalent replacement coverage is claimed. Existing dated evidenceRuns are historical and unchanged, and do not validate this reduced source or current aggregate selectors. Focused candidate execution, if successful, validates only the retained local fake-request/clock tests, not authenticated sockets, rendered clients or platform parity.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/19163"],
      "invariant": "Failed bootstrap and authenticated reconnect converge without UI triggers; one connection owner publishes verified status, with no independent healthy status polling.",
      "oracle": "Audit 3301 removes the failed-verification/recovery/restart generation and host-contact-epoch, hosting and no-toast example from runtime-status-snapshot.test.ts. Earlier prose describing that example as retained is historical. Disconnect/pairing retirement and delayed catalog replay remain unchanged without equivalent replacement. Archive both complete historical 22-case unit receipts because their selector includes the reduced source; preserve the unrelated rendered receipt, current selectors and other-owner assertion references. No fresh aggregate or live host validation is claimed. Linux coverage from those two unit runs is historical; current covered-platform scope is limited to the preserved macOS rendered receipt. Retained local cases check independent waiter deadlines/cancellation, failed-operation recovery, stale deferred results, disposal and explicit reconnect after authentication refusal. Historical aggregate receipts predate audit1748 and are not fresh validation of reduced sources.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts src/renderer/src/store/slices/runtime-status/runtime-status-snapshot.test.ts src/renderer/src/web/web-runtime-status-owner.test.ts",
        "ORCA_BACKGROUND_LAUNCH=1 ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/runtime-host-status-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts",
        "src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts",
        "src/renderer/src/store/slices/runtime-status/runtime-status-snapshot.test.ts",
        "src/renderer/src/web/web-runtime-status-owner.test.ts",
        "tests/e2e/runtime-host-status-recovery.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts",
          "assertions": [
            "retries a failed status operation while retaining healthy transport and last good metadata",
            "disconnect settles readers and prevents late results and retry resurrection"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-10",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_BACKGROUND_LAUNCH=1 ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/runtime-host-status-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "summary": "Desktop-host and headless-host journeys passed with desktop and browser viewers.",
          "durationSeconds": 31.3
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Changed selectors have no new soak result after Audit1348; any retained unchanged-source receipts apply only to their own commands. Historical account: Local candidate runs passed; no sustained CI history yet."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1348 changed referenced test sources; no new red/green validation of the reduced set. Historical account: First-status-failure oracle failed on main 58ff95becb40 (one request instead of two) and passes on the candidate. E2E verifies candidate recovery, not a baseline comparison."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Deterministic tests assert one shared request and no healthy owner polling."
      },
      "promotionCriteria": ["Collect repeated CI runs without unexplained flakes."],
      "knownGaps": [
        "Audit1748 removes7 of13 authored host-status-owner definitions: request/polling counts, reconnect/no-request variants, deadline copy and blocked-reason projections. Lost alarms are intentional; no equivalent replacement coverage is claimed. Existing dated evidenceRuns are historical and unchanged, and do not validate this reduced source or current aggregate selectors. Focused candidate execution, if successful, validates only the retained local fake-request/clock tests, not authenticated sockets, rendered clients or platform parity.",
        "No live Linux, Windows, SSH, or mixed-version pair validation.",
        "TCP interruption exercises reconnect, not a full real host process restart.",
        "The outage begins on the first saved-host check, not by relaunching a preseeded desktop profile.",
        "The test-value audit removes the standalone runtime-status-snapshot.test.ts example that immediately applied the same supplied snapshots to two isolated slice stores. Its direct sequence-2 then older unavailable sequence-1 acceptance/rejection alarm is intentionally lost; it did not exercise a pending read, subscription delivery or a shared viewer connection. The suite retains failed-verification/recovery, disconnect/pairing retirement and catalog-refresh replay examples, which are not equivalent replacements. Historical executed commands, counts and results remain unchanged; no new live host, process restart or platform evidence is claimed.",
        "Audit1348: src/main/ipc/runtime-environments/runtime-environment-status-recovery.test.ts removed. Startup retry/broadcast counts and passive-before-active bootstrap request count. No equivalent replacement coverage is claimed.",
        "Audit1348 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1348 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/ipc/runtime-environments/runtime-environment-status-recovery.test.ts\",\n    \"assertions\": [\n      \"recovers a saved host after its first status check fails, without another UI request\"\n    ]\n  }\n]",
        "Audit 3301 removes the failed-verification/recovery/restart generation and host-contact-epoch, hosting and no-toast example from runtime-status-snapshot.test.ts. Earlier prose describing that example as retained is historical. Disconnect/pairing retirement and delayed catalog replay remain unchanged without equivalent replacement. Archive both complete historical 22-case unit receipts because their selector includes the reduced source; preserve the unrelated rendered receipt, current selectors and other-owner assertion references. No fresh aggregate or live host validation is claimed. Linux coverage from those two unit runs is historical; current covered-platform scope is limited to the preserved macOS rendered receipt.",
        "Audit 3301 retires this complete dated unit receipt because runtime-status-snapshot.test.ts was reduced. Its original command, result and counts remain historical and do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts src/renderer/src/store/slices/runtime-status-snapshot.test.ts src/renderer/src/web/web-runtime-status-owner.test.ts src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts src/renderer/src/store/slices/runtime-status/runtime-status-snapshot.test.ts src/renderer/src/web/web-runtime-status-owner.test.ts\",\n          \"durationSeconds\": 4.37,\n          \"summary\": \"Test Files  4 passed (4); Tests  22 passed (22). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit 3301 retires this complete dated unit receipt because runtime-status-snapshot.test.ts was reduced. Its original command, result and counts remain historical and do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts src/renderer/src/store/slices/runtime-status-snapshot.test.ts src/renderer/src/web/web-runtime-status-owner.test.ts src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/remote-runtime/host-status/runtime-host-status-owner.test.ts src/main/ipc/runtime-environments/runtime-environment-status-connection.test.ts src/renderer/src/store/slices/runtime-status/runtime-status-snapshot.test.ts src/renderer/src/web/web-runtime-status-owner.test.ts\",\n          \"durationSeconds\": 4.52,\n          \"summary\": \"Test Files  4 passed (4); Tests  22 passed (22). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }"
      ],
      "demotionRule": "Keep experimental until repeated runs establish reliability; preserve request-count and lifecycle assertions."
    },
    {
      "id": "mobile-push.headless-startup-and-policy",
      "title": "Headless push lifecycle and mobile delivery policy",
      "maturity": "experimental",
      "protection": "none",
      "owner": "runtime",
      "layer": "service-integration",
      "surfaces": ["headless startup", "push registration", "native push delivery policy"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1670 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Actual startOrcad entry with mocked daemon/RPC startup boundaries; real controller, push service, and persisted device registry. Gateway send is stubbed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/19204"],
      "invariant": "Headless startup installs and disposes push delivery; desktop notification categories remain authoritative, the three-minute away policy is preserved, and host activity cannot extend the seven-day mobile lease.",
      "oracle": "Require registration after RPC identity initialization and shutdown cleanup; idle 179/180/0 yields false/true/false in retained event metadata and exactly one gateway push. Legacy socket subscriptions preserve notification filtering, while opted-in push clients can request dismissal reconciliation. Desktop categories remain authoritative. Persisted lease expires exactly at seven days and only explicit registration renews it.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Target budget; measured p95 not established"
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Focused local run passed; repeated CI history not established."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Headless startup oracle reproduced missing registrar before the startup fix and passed afterward. Policy tests cover candidate behavior."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Lifecycle and policy coverage; asserts exact gateway send counts and zero remaining dispatch listeners after shutdown."
      },
      "promotionCriteria": ["Collect repeated CI runs without unexplained failures."],
      "knownGaps": [
        "Audit1670 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Does not prove APNs silent background wakeup or actual operating-system idle transitions.",
        "Rendererless agent/bell event generation remains outside the documented feature contract.",
        "No live Windows or Linux policy evidence.",
        "Mobile native presentation and dismissal integration belongs to the subsequent mobile PR."
      ],
      "demotionRule": "Keep experimental if lifecycle or policy assertions fail; do not weaken them to bypass platform delivery gaps."
    },
    {
      "id": "agent-session.structured-send-at-most-once",
      "title": "One structured-send attempt dispatches once; a later Send is a new message",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "shared-host-renderer-and-mobile-unit",
      "surfaces": ["desktop native chat", "mobile native chat", "structured agent-session RPC"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "remote-runtime", "mobile"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Retire the full mobile structured-session hook and launch suites, including their mocked send/abort state projections. Current commands, testFiles and evidenceRuns are already empty; prior narratives and archived receipts retain original scopes. Audit1659 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1474 removes the full renderer session-hook suite. Supplied-state projection, mock transport/settings forwarding and assembled shared-owner policy alarms are retired; no equivalent replacement coverage is claimed. The option admission assertion reference was already stale. Reduced selectors have no fresh focused run; historical execution evidence retains its original scope. Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host and direct/Relay transport tests cover per-operation duplicate protection, caller changes, missing host journal rows, acknowledgement loss, and expiry. Mobile tests cover new-action identity, remount, storage refusal, current attachment paths, and capability changes; renderer tests cover one request per send and the bounded hand-back. Live SSH/remote runtimes and physical iOS/Android lifecycle are not exercised. The test-value audit removes the mock send-bridge suite: skills/options/attachment forwarding and accepted/unknown/queued/rejected callback policy no longer have that isolated alarm. Remaining send/draft tests are not claimed as equivalent coverage. Historical run commands and counts are preserved as historical records; a narrowed selector is not a new passed run. Audit1294 removes mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts: Direct performSend composition seeds real journal outcomes but adapter dispatch is never reachable from performSend at all (owner lines90–159: delivery runs separately). Thus both never-redispatch claims are unexercised; caller ledgers are not constructed and supplied acceptance callbacks never execute. Remaining assertions copy seeded unknown state or count one queued row. Lose isolated submission replay/dedup characterization; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/mobile-structured-send-delivery.test.ts, mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1308: src/renderer/src/lib/launch-structured-agent-session.test.ts removed. Unresolvable probe retries, exhausted selector refusal and unknown-outcome create-envelope mock alarms disappear. No equivalent replacement coverage is claimed. Audit1315 removes/narrows mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts, mobile/src/session/use-mobile-structured-agent-session-send.test.tsx, mobile/src/session/use-mobile-structured-agent-session.test.tsx, mobile/src/transport/mobile-relay-rpc-session.test.ts, mobile/src/transport/stable-logical-rpc-client.test.ts, mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx, mobile/src/mobile-web-shell/bridge-host-init.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/20133"],
      "invariant": "One structured-send operation id causes at most one provider dispatch. Each user Send on phone or desktop is a new action with a fresh id and one request; neither automatically resends an ambiguous action. The host retains the original action's outcome, and a later phone Send remains possible with equal text, after remount, or when phone storage fails. Repeated transmission of the same operation remains protected by host deduplication.",
      "oracle": "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Retire the full mobile structured-session hook and launch suites, including their mocked send/abort state projections. Current commands, testFiles and evidenceRuns are already empty; prior narratives and archived receipts retain original scopes. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Inject adapter/RPC acknowledgement loss, caller replacement, logical-client close after response, auth recovery with a written request, missing host submissions, legacy pending rows, stale fences, expiry, mobile remount, and phone storage refusal. Assert at most one dispatch for repeated transmission of one operation. For a later phone Send, assert a fresh id and second delivery while the original host entry remains unknown; equal images use current uploaded paths and delivery fields follow current host capabilities.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Changed selectors have no new soak result after Audit1308; any retained unchanged-source receipts apply only to their own commands. Historical account: Focused local runs pass; repeated CI history is not established."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1308 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The exact phone acknowledgement-loss/later-equal-Send test fails twice with the original sender and classifier restored byte-for-byte: the second Send returns unknown under the earlier id. It passes with per-action identity. Existing host tests also pin cross-caller recovery, missing submissions, and legacy pending rows against repeat dispatch; those host paths were not changed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. No polling, timers, subprocesses, or provider fanout were added. The phone send path no longer reads or writes AsyncStorage or hashes image contents. The existing host admission, pre-effect unknown record, and settlement transactions are unchanged. No capacity-scale host fsync benchmark is recorded."
      },
      "promotionCriteria": [
        "Soak both commands in CI with zero unexplained flakes.",
        "Add live physical-mobile and remote-runtime interruption evidence before claiming full provider coverage."
      ],
      "knownGaps": [
        "Audit1659 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1474 retired complete execution receipt; original fields unchanged: {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx\",\"durationSeconds\":11.53,\"summary\":\"Test Files  8 passed (8); Tests  142 passed (142). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 574edb34b8e5448541e7a69aac098958d91ffb06.\"}",
        "Audit1474 removes the full renderer session-hook suite. Supplied-state projection, mock transport/settings forwarding and assembled shared-owner policy alarms are retired; no equivalent replacement coverage is claimed. The option admission assertion reference was already stale. Reduced selectors have no fresh focused run; historical execution evidence retains its original scope.",
        "Phone composer drafts remain in memory: killing the app between Send and host recording loses that text, as before.",
        "A later intentional Send can deliver another copy of text from an earlier unknown action; the original action stays unresolved until the host can establish its outcome.",
        "A host crash after recording the operation unknown but before journal append or provider dispatch can conservatively suppress an attempt that never reached the provider.",
        "Older phone bundles retain their payload journal behavior until upgraded; legacy embedded-page storage access remains permitted.",
        "No live SSH, remote-runtime, physical iOS/Android, Linux, or Windows interruption run is recorded.",
        "The test-value audit removes the mock send-bridge suite: skills/options/attachment forwarding and accepted/unknown/queued/rejected callback policy no longer have that isolated alarm. Remaining send/draft tests are not claimed as equivalent coverage.",
        "Historical receipt before suite removal; original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-10-07\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-structured-send-new-action.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx ../mobile/src/session/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/session/use-mobile-structured-native-chat-send-bridge.test.ts ../mobile/src/mobile-web-shell/page-storage-keys.test.ts ../mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts ../mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx ../mobile/src/mobile-web-shell/bridge-host-init.test.ts ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":5.42,\"summary\":\"Nineteen focused mobile files passed 241 tests for fresh Send identity, remount, attachment paths, storage refusal, mixed host capabilities, queued cards, and written-request ambiguity.\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-structured-send-new-action.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx ../mobile/src/session/native-chat/composer/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/session/use-mobile-structured-native-chat-send-bridge.test.ts ../mobile/src/mobile-web-shell/page-storage-keys.test.ts ../mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts ../mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx ../mobile/src/mobile-web-shell/bridge-host-init.test.ts ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\"}",
        "Audit1294 removes mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed.",
        "Archived retired-suite historical evidenceRuns (JSON, original fields/results unchanged): [{\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1290-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/session/mobile-structured-send-new-action.test.ts mobile/src/session/use-mobile-structured-agent-session-send.test.tsx mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx mobile/src/session/mobile-structured-send-delivery.test.ts mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx mobile/src/session/use-mobile-structured-agent-session.test.tsx mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx mobile/src/session/native-chat/composer/mobile-native-chat-image-attachment.test.ts mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts mobile/src/mobile-web-shell/page-storage-keys.test.ts mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx mobile/src/mobile-web-shell/bridge-host-init.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/rpc-client-delivery-ambiguity.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-structured-send-new-action.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx ../mobile/src/session/native-chat/composer/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/mobile-web-shell/page-storage-keys.test.ts ../mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts ../mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx ../mobile/src/mobile-web-shell/bridge-host-init.test.ts ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":5.98,\"summary\":\"Test Files  18 passed (18); Tests  264 passed (264). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}]",
        "Audit1302: src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts: Direct performSend composition seeds real journal outcomes but adapter dispatch is never reachable from performSend at all (owner lines90–159: delivery runs separately). Thus both never-redispatch claims are unexercised; caller ledgers are not constructed and supplied acceptance callbacks never execute. Remaining assertions copy seeded unknown state or count one queued row. Lose isolated submission replay/dedup characterization; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.47,\n          \"summary\": \"Eleven focused host, shared, renderer and orchestration files passed 196 tests, including unknown send outcomes, reused message IDs and host replay without duplicate dispatch. The send-idempotency suite pins only that an unknown outcome is never resent; the removed refusal-retry matrix has no replacement here.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 15.7,\n          \"summary\": \"Test Files  10 passed (10); Tests  149 passed (149). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/mobile-structured-send-delivery.test.ts, mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed.",
        "Archived audit1303 retired-suite historical receipt (JSON; original command/currentCommand/results/counts unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1295-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/session/mobile-structured-send-new-action.test.ts mobile/src/session/use-mobile-structured-agent-session-send.test.tsx mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx mobile/src/session/mobile-structured-send-delivery.test.ts mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx mobile/src/session/use-mobile-structured-agent-session.test.tsx mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx mobile/src/session/native-chat/composer/mobile-native-chat-image-attachment.test.ts mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts mobile/src/mobile-web-shell/page-storage-keys.test.ts mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx mobile/src/mobile-web-shell/bridge-host-init.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/rpc-client-delivery-ambiguity.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-structured-send-new-action.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx ../mobile/src/session/native-chat/composer/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/mobile-web-shell/page-storage-keys.test.ts ../mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts ../mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx ../mobile/src/mobile-web-shell/bridge-host-init.test.ts ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"result\":\"passed\",\"durationSeconds\":5.5,\"summary\":\"Test Files  17 passed (17); Tests  260 passed (260). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1308: src/renderer/src/lib/launch-structured-agent-session.test.ts removed. Unresolvable probe retries, exhausted selector refusal and unknown-outcome create-envelope mock alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1308 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.47,\n          \"summary\": \"Eleven focused host, shared, renderer and orchestration files passed 196 tests, including unknown send outcomes, reused message IDs and host replay without duplicate dispatch. The send-idempotency suite pins only that an unknown outcome is never resent; the removed refusal-retry matrix has no replacement here.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\"\n        }",
        "Audit1308 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 15.7,\n          \"summary\": \"Test Files  10 passed (10); Tests  149 passed (149). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session/lifecycle/agent-session-operation-ledger.test.ts src/shared/agent-session/requests/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session/ownership/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts\",\"durationSeconds\":11.86,\"summary\":\"Test Files  9 passed (9); Tests  145 passed (145). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 36536504876bf7fa79c79256377cde97f1f3a133.\"}",
        "Audit1315 removes/narrows mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1341 scope1334 removes/narrows mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/composer/use-mobile-native-chat-image-attachments.test.ts, mobile/src/session/use-mobile-structured-agent-session-send.test.tsx, mobile/src/session/use-mobile-structured-agent-session.test.tsx, mobile/src/transport/mobile-relay-rpc-session.test.ts, mobile/src/transport/stable-logical-rpc-client.test.ts, mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx, mobile/src/mobile-web-shell/bridge-host-init.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Retire the full mobile structured-session hook and launch suites, including their mocked send/abort state projections. Current commands, testFiles and evidenceRuns are already empty; prior narratives and archived receipts retain original scopes.  All prior notes and dated/archived evidence retain original scopes."
      ],
      "demotionRule": "Keep experimental or demote if one operation dispatches twice, uncertainty is reported as definite rejection, a later phone Send reuses the earlier action or is blocked by phone storage, or the focused commands flake without a diagnosed harness defect."
    },
    {
      "id": "agent-session.completed-turn-duration",
      "title": "Completed turn duration survives client recovery and history pagination",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "shared-and-renderer-unit",
      "surfaces": ["native chat", "structured agent history", "structured agent subscriptions"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "remote-runtime", "mobile"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1348 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Deterministic provider, journal recovery, RPC projection and shared renderer tests run on macOS. Shared logic serves desktop and mobile; these tests do not prove native mobile or real SSH transport. Local/daemon PTY input, geometry and WSL process launch are unaffected. Test-value audit1293 removes src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts (5 authored cases), src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1348: src/main/codex/structured/turns/codex-requested-close-turn-timing.test.ts removed. Requested/unexpected close event timing/fence metadata after a hand-supplied refused terminal receipt. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/19695"],
      "invariant": "An observed completed turn retains the same host-recorded duration and initiating user-message attribution through client reload, settlement retry and loading older history; older clients receive the compatible item carrier, and a host-recorded unknown duration suppresses local estimates.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1348 retired changed-source receipts. Historical oracle account: Render a host-settled duration without observing completion locally; preserve an exit at 2000 through failed settlement at 60000 and later retry; retain a seven-second older turn beyond 256 submitted turns; prune aliases with removed user items and preserve alias identity during item-only streaming; render no completed duration for an unverifiable turn both before and after client reload.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1348 retired changed-source receipts; reduced selector has no new soak result. Historical account: No CI soak history for this combined gate."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1348 changed referenced test sources; no new red/green validation. Historical account: Before fixes, failed settlement stored 60000 instead of observed 2000 and older-page duration was undefined instead of seven seconds after 257 submissions. Mounted unverifiable recovery also displayed a local 59 seconds versus no duration after reload, including an older-host row without a start; the focused regressions pass after fixes."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1348 changed test sources; no new measurement. Previous account: No polling, process fanout or new timer. Alias retention follows loaded user items plus 256 recent records; lookup uses a Set, removal/reset prunes aliases, and item-only stream batches retain the submission array identity."
      },
      "knownGaps": [
        "This deterministic gate does not launch Electron or prove a full app restart; exact-head manual screenshots are separate PR evidence.",
        "Native mobile, live SSH/relay transport and Windows/Linux execution are not exercised by this command.",
        "Accumulated-history wall-clock profiling and CI soak remain unmeasured.",
        "Test-value audit1293 removes src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts (5 authored cases), src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-10-10\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node config/scripts/run-vitest.mjs run --config config/vitest.config.ts src/shared/native-chat-unverifiable-turn-status.test.ts src/main/codex/codex-requested-close-turn-timing.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts src/shared/structured-agent-session-turn-timing-retention.test.ts src/shared/structured-agent-session-turn-timing.test.ts src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx --maxWorkers=4 --reporter=json --outputFile=notes/bun-migration/performance/ci-throughput-resume-20261009/next_capacity_wave_owner/reliability-path-correction/fresh-eight-root-stock-config.json\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 node config/scripts/run-vitest.mjs run --config config/vitest.config.ts src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts src/main/codex/codex-requested-close-turn-timing.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing.test.ts src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx --maxWorkers=4 --reporter=json --outputFile=notes/bun-migration/performance/ci-throughput-resume-20261009/next_capacity_wave_owner/reliability-path-correction/fresh-eight-root-stock-config.json\",\"result\":\"passed\",\"durationSeconds\":5.688707999999999,\"summary\":\"87 tests passed across exactly eight current files at source commit aea00c5c02c3dccaa83aee3207ba6fcb586ffa5c using stock config/vitest.config.ts, Node 24.21.0, Bun 1.4.2 and four workers; no failures, skips or todo. Natural CLI close took 5.688708 seconds. The prior 2026-09-09 record (58 tests, 4.65 seconds, source 5acb404bf244cdc0bd3643c4e79beb189ce9a0cd) is preserved verbatim in Git history and notes/bun-migration/performance/ci-throughput-resume-20261009/next_capacity_wave_owner/reliability-path-correction/before.jsonc. This manifest-only change records the new run without changing tested source.\"}",
        "Audit1348: src/main/codex/structured/turns/codex-requested-close-turn-timing.test.ts removed. Requested/unexpected close event timing/fence metadata after a hand-supplied refused terminal receipt. No equivalent replacement coverage is claimed.",
        "Audit1348 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts src/main/codex/codex-requested-close-turn-timing.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing.test.ts src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node config/scripts/run-vitest.mjs run --config config/vitest.config.ts src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts src/main/codex/structured/turns/codex-requested-close-turn-timing.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing.test.ts src/main/codex/structured/journal/codex-structured-journal-translation-turn-lifecycle.test.ts src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx --maxWorkers=4 --reporter=json --outputFile=notes/bun-migration/performance/ci-throughput-resume-20261009/next_capacity_wave_owner/reliability-path-correction/fresh-eight-root-stock-config.json\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.42,\n          \"summary\": \"Test Files  7 passed (7); Tests  48 passed (48). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1348 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1348 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts\",\n    \"assertions\": [\n      \"does not convert a running turn to local Worked for after unverifiable recovery (start %s)\"\n    ]\n  },\n  {\n    \"file\": \"src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts\",\n    \"assertions\": [\n      \"keeps exit receipt %s on retry\"\n    ]\n  },\n  {\n    \"file\": \"src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts\",\n    \"assertions\": [\n      \"keeps an older page duration after the recent submission budget fills\",\n      \"drops an old alias once rewind removes its user item\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx\",\n    \"assertions\": [\n      \"renders a host-settled duration without ever clocking the turn locally\"\n    ]\n  }\n]",
        "Audit1348 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/codex/structured/turns/codex-requested-close-turn-timing.test.ts\",\n    \"assertions\": [\n      \"keeps the first exit receipt when retry requestedClose=%s\"\n    ]\n  }\n]",
        "Retired selector metadata during audit1352; historical selector record preserved unchanged: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 node config/scripts/run-vitest.mjs run --config config/vitest.config.ts src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts src/shared/agent-session/view/structured-agent-session-turn-timing.test.ts src/main/codex/structured/journal/codex-structured-journal-translation-turn-lifecycle.test.ts src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx --maxWorkers=4 --reporter=json --outputFile=notes/bun-migration/performance/ci-throughput-resume-20261009/next_capacity_wave_owner/reliability-path-correction/fresh-eight-root-stock-config.json\"],\"testFiles\":[\"src/shared/native-chat/transcript/native-chat-unverifiable-turn-status.test.ts\",\"src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts\",\"src/shared/agent-session/view/structured-agent-session-turn-timing-retention.test.ts\",\"src/shared/agent-session/view/structured-agent-session-turn-timing.test.ts\",\"src/main/codex/structured/journal/codex-structured-journal-translation-turn-lifecycle.test.ts\",\"src/renderer/src/components/native-chat/NativeChatMessageList.turn-membership.test.tsx\"],\"assertionRefs\":[]}"
      ],
      "promotionCriteria": [
        "Complete CI soak without unexplained flakes and retain the value-based retry, pagination and rendering oracles."
      ],
      "demotionRule": "Keep experimental until soak and platform evidence support promotion; do not relax value or identity assertions to hide failures."
    },
    {
      "id": "workspace-session.ssh-host-partition-round-trip",
      "title": "An SSH workspace round-trips through its own partition without losing tabs, editor files or browser state",
      "maturity": "experimental",
      "protection": "none",
      "owner": "workspace-session-persistence",
      "layer": "persistence-integration",
      "surfaces": ["workspace session partitions", "boot session hydration"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1899 replays sealed Audit1895: workspace-session-partition-owner.test.ts is entirely removed. Runtime/SSH/local partition pass-through and invalid-host fallback examples, including the referenced SSH partition assertion, are intentionally lost. Retained renderer in-memory partition composition is not equivalent replacement coverage. The sole affected September15 receipt is retired verbatim; no new gate, SSH, durable-storage, mobile or restart execution is claimed. Historical coverage account before Audit1899: The test-value audit retains renderer in-memory read/write composition for editor-only drafts, contested primary/shadow rows, declined-sibling preservation, and two-cycle legacy repair/tombstone handling. Separate supplied routing, folder ownership, field-selection and hydration examples were removed; their alarms are lost. APIs are fixtures: no durable persistence, real SSH delivery, PTY lifecycle, mobile rendering or actual restart is established. Historical run evidence is preserved and does not establish the current narrowed suite.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/12721",
        "https://github.com/stablyai/orca/issues/18173",
        "https://github.com/stablyai/orca/blob/main/src/shared/workspace-session/workspace-session-partition-owner.ts"
      ],
      "invariant": "Every workspace the `ssh:<targetId>` partition names is hydrated at boot, whatever kind of state it holds - terminal tabs, open editor files with unsaved hot-exit drafts, browser workspaces, tab groups, or host-qualified visit recency. An empty tab row is read as a gap, never as evidence the tabs were closed. A workspace the local partition already holds terminal tabs for is left untouched, and every workspace routes back to the partition that owns it. Adoption never destroys what it was not told about: a host row the partition holds nothing for cannot replace a populated base row, and a bare id the read found contested is gap-filled rather than replaced, because that is exactly the id where `local` and `ssh:<targetId>` are not one workspace written twice. Tab-, pane- and file-keyed rows are recovered through the same indexes the split routed them by. An explicit empty tab row written by this build survives the round trip as a present empty row and is declined by the shared seeding predicate. Boot enumerates the partitions persistence actually holds rather than inferring them from the repo catalog, so a target whose only workspace is a folder is read like any other; a folder workspace routes to the same partition main's RuntimeWorkspaceSessionController writes it to, so one workspace is never written into two stores; and a workspace adopted out of a partition routes back to that partition even on a boot whose repo catalog cannot name the host, so the write cannot re-strand what the read just reunited. `contested` means a repo id the catalog registers on more than one host, or two SSH partitions naming one id - never the mere co-presence of 'local' and `ssh:<targetId>`, which is the repair's own input.",
      "oracle": "No current execution receipt validates the reduced selector after Audit1895 removes the partition-owner suite. Retained renderer composition remains an unexecuted static inventory for this replay and does not replace its removed direct routing alarms. Historical prior-source oracle: Drive the shipping split and renderer read together for an editor-only draft, a contested primary plus parked shadow, and legacy repair followed by a closed-last-terminal round trip. Drive an assembled read into addressed patch callbacks while writing a sibling and require the declined row to survive in its own partition. These in-memory composition checks do not establish file durability or actual reboot recovery.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical pre-Audit1899 selector budget; the reduced command has no new runtime measurement. Previous scope: Real Store on a temp profile plus renderer partition units; no launched app and no relay."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Deterministic local validation only; no CI soak yet. The tests have no timers, network or real relay."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Historical pre-Audit1899 source/selector account; no new red/green execution establishes the reduced command. Previous account: Against pristine main 12f53da542d, 9 of the 11 assertions that target the original defect fail: the boot read returns no tabs, the export publishes an empty tabsByWorktreePath row, the round trip ends with the tabs deleted, routing answers local instead of ssh:target-1, and an older client's empty publish deletes the tabs on pull. The remaining assertions guard the fix itself rather than main's bug: review found that gating adoption on terminal tabs stranded editor-only and browser-only SSH workspaces, destroying unsaved hot-exit drafts no other channel can recover. The gate now discovers a workspace through an exhaustive switch over the field-ownership table, and reintroducing the tabs-only gate fails 6 assertions including the write/read round trip."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Historical pre-Audit1899 account; the reduced selector has no fresh performance measurement. Previous account: Boot adds one session:get per SSH host that owns a repo, issued in parallel with the existing runtime partition reads and served from already-loaded main state. The publish fallback adds one partition read and a shallow keyed-record merge per target, which returns its input unchanged when nothing is stranded and stays the same order as the projection it feeds."
      },
      "knownGaps": [
        "No live SSH host or relay is exercised; the multiplexer is faked at the request boundary.",
        "The publish fallback reads only 'local' and the target's own partition, so it cannot see the local/runtime rivalry or a second SSH partition the renderer's read can. Bounded rather than closed: a key either side would judge differently is one whose repo id resolves ambiguously or to another host, and the export already publishes those to nobody.",
        "A lingering `ssh:<targetId>` partition for a connection the user removed is now read by the census. Its rows stay in that partition rather than spilling into 'local', and the deregistered-repo residue sweep already clears repo-backed ones, but a folder workspace left behind by a removed connection is not swept.",
        "Rows stranded beside a workspace the local partition already holds terminal tabs for are deliberately not recovered, and no assertion claims they are.",
        "One-shot resurrection in the legacy-transition shape: where an older build left an empty local row while the runtime partition still holds that workspace's tabs, boot adopts them back once. Non-destructive, and non-recurrence is now asserted rather than argued - a workspace this build empties writes its empty row to the owning partition and leaves no local row behind, so there is nothing left to resurrect from.",
        "A contested bare id is gap-filled rather than replaced, so rows stranded beside a contested workspace stay stranded. Separating them needs host-qualified keys through the tab store, which is the same open gap `workspace-session-host-contention.ts` records.",
        "A `local` row left by a repo registration the user removed, whose repo id the catalog now resolves to the SSH host alone, is neither ambiguous nor foreign, so a populated host row still replaces it - including an unsaved `dirtyDraftContent`. Unchanged from main; closing it needs host-qualified keys, the same gap `workspace-session-host-contention.ts` records.",
        "A bare `lastVisitedAtByWorktreeId` stamp left in 'local' for a workspace now owned by an SSH partition gap-fills rather than replaces, so the workspace can keep an older Cmd+J position for one boot after the migration.",
        "`lastVisitedAtByWorktreeId` still discovers a workspace as adoptable from a recency entry alone. Harmless now that a recency row cannot replace another host's entry for the same bare id, but it means recency is a discovery trigger and no other field of its kind is.",
        "Audit1899 retires this complete 2026-09-15 execution receipt because Audit1895 deletes a selected source. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts src/renderer/src/lib/workspace-session-ssh-partition-ownership.test.ts src/renderer/src/lib/workspace-session-host-contention.test.ts src/shared/workspace-session-partition-owner.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-round-trip.test.ts src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-ownership.test.ts src/renderer/src/lib/workspace/persistence/workspace-session-host-contention.test.ts src/shared/workspace-session/workspace-session-partition-owner.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.13,\n          \"summary\": \"64 tests passed across 5 files: the real Store publish, the shipping write/read split round trip, the older-client empty-publish skew direction, the contested-bare-id and empty-host-row guards, the closed-last-terminal tombstone boundary, and the partition-ownership suite covering folder-workspace routing, the persistence-side partition census, read-source write-back, and the catalog attribution that keeps a residue partition from winning the read.\"\n        }",
        "Audit1899 replays sealed Audit1895: workspace-session-partition-owner.test.ts is entirely removed. Runtime/SSH/local partition pass-through and invalid-host fallback examples, including the referenced SSH partition assertion, are intentionally lost. Retained renderer in-memory partition composition is not equivalent replacement coverage. The sole affected September15 receipt is retired verbatim; no new gate, SSH, durable-storage, mobile or restart execution is claimed.",
        "Audit1898 schema disposition: no active passed receipt remains for this gate, so protection:none requires no live commands, testFiles or assertionRefs. Retained test source files still exist; their reduced inventory is historical and unvalidated as a gate, not replacement coverage. Complete original selector/assertion arrays before removal follow verbatim:\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-round-trip.test.ts src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-ownership.test.ts src/renderer/src/lib/workspace/persistence/workspace-session-host-contention.test.ts src/shared/workspace-session/workspace-session-partition-owner.test.ts\"\n      ]\ntestFiles: [\n        \"src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-round-trip.test.ts\",\n        \"src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-ownership.test.ts\",\n        \"src/renderer/src/lib/workspace/persistence/workspace-session-host-contention.test.ts\",\n        \"src/shared/workspace-session/workspace-session-partition-owner.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-round-trip.test.ts\",\n          \"assertions\": [\n            \"still fills a gap on a contested id\",\n            \"sends an editor-only SSH workspace to its partition and reads it back\",\n            \"resurrects the legacy-transition shape exactly once and not again\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/workspace/persistence/workspace-session-ssh-partition-ownership.test.ts\",\n          \"assertions\": [\n            \"keeps a declined row in its own partition when a sibling workspace is written\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/workspace/persistence/workspace-session-host-contention.test.ts\",\n          \"assertions\": [\"does not strand the runtime co-claimant when the SSH row is written\"]\n        },\n        {\n          \"file\": \"src/shared/workspace-session/workspace-session-partition-owner.test.ts\",\n          \"assertions\": [\n            \"gives an SSH host its own partition, matching what the runtime already writes\"\n          ]\n        }\n      ]"
      ],
      "promotionCriteria": [
        "Complete the CI soak requirement with no unexplained flakes.",
        "Add coverage for a live SSH target before claiming the ssh provider is exercised end to end."
      ],
      "demotionRule": "Keep experimental until CI soak completes. Investigate any failure without weakening the empty-row-is-a-gap oracle, which is the assertion the data-loss fix rests on."
    },
    {
      "id": "agent-session.history-forward-read-budget",
      "title": "Journal catch-up reads only the next page and one lookahead row",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "runtime-unit",
      "surfaces": ["structured agent history", "structured agent subscriptions"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed. No passed current receipt validates the reduced selector. Historical coverage account: The real SQLite journal and production subscriber delivery are exercised with a folder workspace and remote host identity. The SQL and pagination code is shared across execution hosts; live SSH transport and Linux/Windows runtime execution are not exercised. PTY, daemon, WSL execution, and mobile rendering are unaffected. Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1371 removes two weak journal-row-writer.spec.ts registrations from the journal directory selector. Forward-read-budget callbacks are untouched, but the mixed complete receipt is historical and is not reassigned to the reduced selection. No equivalent replacement or fresh runtime result is claimed. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed. Audit1739 removes 53 of 118 authored journal/wire definitions, including 11 entire files and four driver registrar imports. Lost alarms include projection/schema tables, cursor helper branches, weak stale-liveness properties, standalone first-damage/missing-epoch diagnostics and narrow persistence copies. Retained callbacks are unchanged; this removal is not equivalent replacement coverage. Focused candidate execution is recorded separately and does not establish performance, red/green, CI soak, live providers, remote execution or cross-platform coverage.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts"
      ],
      "invariant": "Forward catch-up preserves every item, revision, tombstone, sequence cursor, page byte bound, and reset behavior while reading at most the requested row count plus one from SQLite for each page.",
      "oracle": "No current automated execution oracle is claimed after affected receipts were retired. Historical oracle account: Reconnect a real subscriber to a 2,000-row journal and receive all 2,000 item identities in order through the live cursor; count the actual SQL rows returned and parsed as 2,009 instead of 11,000. Assert exact final-page hasNewer, unlimited reader compatibility, gap detection at the next page, and parse-stop behavior at the lookahead row. Existing history tests cover revisions, tombstones, byte-bound shrinking, epochs, and schema resets.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector runtime budget; changed selector has no fresh runtime measurement. Unchanged receipts retain their own command scope."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1379 reduced selector has no fresh soak result. Historical account: Initial deterministic local validation; CI soak has not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1379 changes test sources; reduced selector has no fresh red/green result. Historical account: Before the change, SQL returned 2,000, 1,800, 1,600 through 200 rows across ten pages, failing the count assertion. The bounded query returns nine pages of 201 rows and a final 200, with exactly 2,009 row parses and identical item delivery."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical prior-selector budget; reduced selector has no fresh measurement. Previous account: Catch-up materialization and JSON parsing are linear in unseen journal rows plus page lookaheads. A cached parameterized LIMIT adds no polling, cache invalidation, output loss, protocol change, or provider calls."
      },
      "knownGaps": [
        "Audit1739 removes 53 of 118 authored journal/wire definitions, including 11 entire files and four driver registrar imports. Lost alarms include projection/schema tables, cursor helper branches, weak stale-liveness properties, standalone first-damage/missing-epoch diagnostics and narrow persistence copies. Retained callbacks are unchanged; this removal is not equivalent replacement coverage. Focused candidate execution is recorded separately and does not establish performance, red/green, CI soak, live providers, remote execution or cross-platform coverage.",
        "Linux and Windows execution and live SSH transport have not been exercised.",
        "The existing full reduced-state snapshot and batch projection cost are outside this SQL read budget.",
        "Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-09-07\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\"result\":\"passed\",\"durationSeconds\":9.94,\"summary\":\"214 tests passed across 19 files, including actual SQLite row and JSON parse counts through production subscriber catch-up.\"}",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\"result\":\"passed\",\"durationSeconds\":35.19,\"summary\":\"Test Files  51 passed (51); Tests  689 passed (689). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1324 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\"durationSeconds\":35.55,\"summary\":\"Test Files  48 passed (48); Tests  673 passed (673). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 574edb34b8e5448541e7a69aac098958d91ffb06.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\"durationSeconds\":34.68,\"summary\":\"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 49e2978f83d521bd487e52e0b8b21a1902834caf.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\"durationSeconds\":40.08,\"summary\":\"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 4fa83106fcdb5ffd53ad527bf59f83b72aec2285.\"}",
        "Test-value audit1327-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1327-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\n          \"durationSeconds\": 35.48,\n          \"summary\": \"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\n          \"durationSeconds\": 35.48,\n          \"summary\": \"Test Files  48 passed (48); Tests  676 passed (676). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Audit1371 removes two weak journal-row-writer.spec.ts registrations from the journal directory selector. Forward-read-budget callbacks are untouched, but the mixed complete receipt is historical and is not reassigned to the reduced selection. No equivalent replacement or fresh runtime result is claimed.",
        "Historical receipt retired by audit1372 at 1f0e6b60b1cb31fc3aebaf573da5957297c8c613; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\n          \"durationSeconds\": 53.43,\n          \"summary\": \"Test Files  50 passed (50); Tests  717 passed (717). One shared execution of the same selector set validates both journal gates. Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"\n        }",
        "Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed.",
        "Audit1379 retires this complete actual-current dated receipt because its selector includes a deleted or reduced source. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm --config.verifyDepsBeforeRun=false exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-journal\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 49.95,\n          \"summary\": \"Test Files  50 passed (50); Tests  714 passed (714). Source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Current retained unit selection only. No removed-case replacement, live provider, native input, rendered Electron E2E, performance threshold or soak claim. Node24.22.0 with ORCA_BACKGROUND_LAUNCH=1 and an isolated Xvfb display. currentCommand retains the same selectors; execution adds a worker limit and disables dependency preflight.\"\n        }",
        "Audit1379 historical platform/provider scope: {\"coveredPlatforms\":[\"linux\"],\"coveredProviders\":[]}. Remaining evidence applies to unchanged-source commands only.",
        "Audit1379 retained assertion inventory awaiting validation of the reduced selector:\n[\n  {\n    \"file\": \"src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts\",\n    \"assertions\": [\n      \"keeps an exact final page final and preserves unlimited journal readers\",\n      \"reports a sequence gap when the next page reaches it\",\n      \"preserves parse-stop behavior at lookahead: %s\"\n    ]\n  }\n]"
      ],
      "promotionCriteria": [
        "Complete CI soak requirements while preserving the deterministic row budget and pagination oracles."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate fidelity or count failures without relaxing the row budget."
    },
    {
      "id": "agent-session.hibernation-runtime-inventory-budget",
      "title": "Hibernation preserves fresh host evidence and shutdown safety",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session-runtime",
      "layer": "shared-and-renderer-unit",
      "surfaces": ["automatic agent hibernation", "remote terminal liveness"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3368 retires the whole hibernation coordinator suite and intentionally loses supplied inventory/liveness/attention/confirmation/changed-workspace/sequential teardown alarms without equivalent replacement. The sole compound dated receipt is retired verbatim; no shortened command inherits its results. With no active evidence, protection/platform/provider evidence clears and ALL current commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps. Other source files remain in the broad suite. Prior red/green/flake accounts are historical only; no fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit2058 intentionally retires the standalone visibility subscription/callback-count alarm without replacement. Audit2310 additionally retires two pane-age getter-map expiry/pruning samples without equivalent replacement. The reduced five-source hibernation selector was freshly run on Linux:52 tests pass. The earlier 54-test receipt is archived verbatim in knownGaps and does not validate the reduced source. Its prior macOS execution receipt/current-command association is archived verbatim in knownGaps and is not current execution evidence for the reduced selector. Current covered platform is Linux; remote replies remain scripted, with no live SSH/WSL/native provider or p95 claim. Historical prior account (preserved verbatim): Local hibernation, remote inventory authority and folder-workspace identity are covered by coordinator/model contracts on macOS. Daemon, SSH, WSL, relay and native platform execution boundaries and existing RPC payloads are unchanged. Current assertions cover shutdown safety and owning-host selection; historical inventory-count and performance evidence below is retained for provenance and is not current count coverage.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/lib/agent-hibernation-coordinator.test.ts"
      ],
      "invariant": "Automatic hibernation must retain two stable confirmations and fresh execution-host evidence before shutdown. Skipping a workspace with no completed agent must not authorize a newly completed pane using stale client PTYs.",
      "oracle": "Audit3368 retires the whole hibernation coordinator suite and intentionally loses supplied inventory/liveness/attention/confirmation/changed-workspace/sequential teardown alarms without equivalent replacement. The sole compound dated receipt is retired verbatim; no shortened command inherits its results. With no active evidence, protection/platform/provider evidence clears and ALL current commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps. Other source files remain in the broad suite. Prior red/green/flake accounts are historical only; no fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit2058 intentionally retires the standalone visibility subscription/callback-count alarm without replacement. Audit2310 additionally retires two pane-age getter-map expiry/pruning samples without equivalent replacement. The reduced five-source hibernation selector was freshly run on Linux:52 tests pass. The earlier 54-test receipt is archived verbatim in knownGaps and does not validate the reduced source. Its prior macOS execution receipt/current-command association is archived verbatim in knownGaps and is not current execution evidence for the reduced selector. Current covered platform is Linux; remote replies remain scripted, with no live SSH/WSL/native provider or p95 claim. Historical prior account (preserved verbatim): Working and waiting agents across remote workspaces must not be shut down. A skipped workspace completing while another inventory awaits remains ineligible until two later host-confirmed passes, and so does a workspace that only becomes runtime-owned while an inventory is outstanding — a pass carrying no host evidence for a workspace never counts as one of its two confirmations. Folder and git workspaces hibernate the exact host PTY; rejected/truncated inventories and intervening input/output or state changes block shutdown.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Focused unit/provider-contract suite; local runtime budget, not an established p95."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit3368 retires sole active dated receipt. No fresh execution/soak validates current coverage; complete original account preserved verbatim as history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit3368 changes/deletes referenced sources. No fresh red/green proof validates reduced coverage; original complete account preserved verbatim in knownGaps as history."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The 100-workspace fixture falls from 100 terminal.list calls plus one compatibility handshake to zero calls. Two-workspace confirmation/recheck fixture falls from five inventories to three. A single status scan and tab membership lookups precede existing requests. Recomputing the required-worktree set from the post-await state adds one in-memory owner resolution per workspace per tick and no RPC. No new timer, concurrency, subprocess or retry; only active when experimental automatic hibernation is enabled."
      },
      "knownGaps": [
        "Remote contracts use mocked runtime replies; no live SSH/network-fault, Windows/Linux/WSL or relay run.",
        "This improves the experimental automatic hibernation path only; it does not remove inventories for workspaces that contain completed agents.",
        "Historical audit2058 coverage note before audit2310, preserved verbatim; not current execution evidence: Audit2058 intentionally retires the standalone visibility subscription/callback-count alarm without replacement. The remaining five-source hibernation selector was freshly run on Linux:54 tests pass. Its prior macOS execution receipt/current-command association is archived verbatim in knownGaps and is not current execution evidence for the reduced selector. Current covered platform is Linux; remote replies remain scripted, with no live SSH/WSL/native provider or p95 claim.",
        "Audit2058 archives this exact historical receipt after deleting a selector in its currentCommand; historical provenance only, not current execution evidence:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-hibernation-confirmation.test.ts src/renderer/src/lib/agent-hibernation-pane-age.test.ts src/renderer/src/lib/agent-hibernation-output-activity.test.ts src/renderer/src/lib/agent-hibernation-visibility.test.ts src/renderer/src/lib/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-hibernation-runtime-liveness-race.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-visibility.test.ts src/renderer/src/lib/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 48.18,\n          \"summary\": \"93 tests passed across eight coordinator, liveness-race, planner, confirmation, age, activity and visibility files.\"\n        }",
        "Historical receipt retired by audit2310 because two pane-age getter-map registrations were removed; original record preserved verbatim, not current execution evidence:\n{\n          \"date\": \"2026-11-08\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts src/renderer/src/lib/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.377,\n          \"summary\": \"54 tests across five unchanged coordinator/planner/age/foreground/liveness-race files passed on the actual39644 squash plus test-removal candidate. Reduced selector only; scripted runtime contracts, no live SSH/native WSL, soak or measured p95 claim.\"\n        }",
        "Audit3368 retires the whole hibernation coordinator suite and intentionally loses supplied inventory/liveness/attention/confirmation/changed-workspace/sequential teardown alarms without equivalent replacement. The sole compound dated receipt is retired verbatim; no shortened command inherits its results. With no active evidence, protection/platform/provider evidence clears and ALL current commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps. Other source files remain in the broad suite. Prior red/green/flake accounts are historical only; no fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3368 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts src/renderer/src/components/terminal-pane/parking/retention/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts --maxWorkers=2\"\n      ]",
        "Audit3368 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts\",\n        \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts\",\n        \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/foreground-terminal-tabs.test.ts\",\n        \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts\"\n      ]",
        "Audit3368 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts\",\n          \"assertions\": [\n            \"does not hibernate working or waiting agents across remote workspaces\",\n            \"requires host evidence after a skipped workspace completes during another inventory request\",\n            \"hibernates a runtime-backed candidate in %s with fresh liveness and exact PTYs\",\n            \"fails closed on truncated runtime liveness samples\",\n            \"fails closed when fresh runtime liveness rejects after an earlier good sample\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts\",\n          \"assertions\": [\n            \"requires host evidence when a workspace becomes runtime-owned during an inventory request\"\n          ]\n        }\n      ]",
        "Audit3368 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        {\n          \"date\": \"2026-11-08\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts src/renderer/src/lib/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/agent-session/hibernation/agent-hibernation-coordinator.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-planner.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-pane-age.test.ts src/renderer/src/components/terminal-pane/parking/retention/foreground-terminal-tabs.test.ts src/renderer/src/lib/agent-session/hibernation/agent-hibernation-runtime-liveness-race.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.426,\n          \"summary\": \"52 tests across the five coordinator/planner/age/foreground/liveness-race files passed on public parent60aee85d9182f602af45cf5f6facae7257670061 plus the audit2310 test-removal candidate (source tree da2595af5391e9fa07a924ac69afede47ad31906). Includes the reduced two-case pane-age suite. Scripted runtime contracts; no live SSH/native WSL, soak or measured p95 claim.\"\n        }\n      ]",
        "Audit3368 historical original protection object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"partial\"",
        "Audit3368 historical original coveredPlatforms object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"linux\"]",
        "Audit3368 historical original coveredProviders object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"local\", \"remote-runtime\"]",
        "Audit3368 historical original redGreenEvidence object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"complete\",\n        \"evidence\": \"Baseline made 101 runtime calls in the new no-completed-agent fixture; candidate makes zero. Existing confirmation, final recheck and failure-path assertions continue to pass, including completion during an outstanding request. Separately, baseline hibernated a workspace that became runtime-owned mid-inventory one tick early, taking its first confirmation from a pass planned entirely from client PTYs; candidate withholds that pass and requires two host-confirmed ones.\"\n      }",
        "Audit3368 historical original flakeHistory object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"not-started\",\n        \"evidence\": \"Initial local validation; no CI soak history.\"\n      }"
      ],
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity, liveness or shutdown-safety assertions."
    },
    {
      "id": "terminal-performance.osc-status-scan-budget",
      "title": "OSC 9999 status bursts reuse forward terminator searches",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "shared-unit-and-runtime-unit",
      "surfaces": ["terminal output ingestion", "terminal agent-status side effects"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1342 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Shared parser tests cover provider-independent bytes; main and renderer contract tests cover status and terminal-output delivery. Live Linux, Windows, WSL, SSH and remote-runtime processes are not launched. Execution, liveness, paths, wire formats and mobile UI are unchanged. Audit1287 removes the mixed-terminator/malformed-frame example from agent-status-osc.test.ts. Its earliest mixed BEL/ST, malformed-frame removal and individual payload-offset alarms are intentionally lost. The every-split and pending-cap registrations remain; no equivalent replacement is claimed. The stricter test-value policy removes agent-status-osc-scan-budget.test.ts entirely. Its primitive String/RegExp search-work budgets and legacy RegExp.input retention alarm are intentionally lost. Current parser correctness fixtures are not equivalent search-budget or retention coverage; no new performance, runtime, platform or mobile evidence is claimed. The complete dated153-test receipt was already archived verbatim by Audit1287 and does not validate the shortened selector. A fresh parent execution is needed for current survivor coverage. Audit1318: src/shared/agent-status/contracts/agent-status-types.test.ts: Schema/field/truncation/enum inventories and JSON.parse call counts characterize status normalization over supplied values. Intentionally lose oversized question validity, Unicode surrogate clipping, stale-field rejection, freshness and dispatch-marker parsing alarms; no producer delivery or rendered interaction and no equivalent replacement. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/shared/agent-status/transport/agent-status-osc.ts"
      ],
      "invariant": "Terminal status parsing preserves ordinary UTF-16 output, every valid payload in order, the last valid payload's clean-output offset, earliest BEL/ST termination, and incomplete-frame caps while searching each complete burst only forward.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1342 retired changed-source receipts. Historical oracle account: Two 5,000-frame bursts using exclusively BEL or ST produce every expected payload and ordinary output byte with at most twice the input length in the counted indexOf, charCodeAt and RegExp.exec search ranges. This is a deterministic primitive-search regression alarm, not a total CPU or memory cost model. Every split through prefixes/JSON/ST, independent parser interleaving, exact pending-cap boundaries and oversized complete frames retain bounded parser checks. Parsed output chunks are not retained in legacy regular-expression state.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1342 retired changed-source receipts; reduced selector has no new soak result. Historical account: Initial deterministic local validation; CI soak has not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation. Historical account: The unchanged parser failed both search budgets: 618,560,785 searched characters for the 246,390-character BEL burst and 631,068,285 for the 251,390-character ST burst. Reusing forward match positions reduces those totals to 492,770 and 502,770 characters respectively, within twice the input length, with identical complete results."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1342 changed test sources; no new measurement. Previous account: Warmed Node 24 macOS CPU medians: a 250 KB / 5,000-status burst fell from 100.240 ms to 1.903 ms; a 1 MB / 20,000-status burst fell from 1,588.492 ms to 7.369 ms. Wall-clock medians were 134.878 to 2.484 ms and 2,536.927 to 12.902 ms under concurrent machine load. These are adverse bursts, not typical callback sizes. The ordinary-output path is unchanged; one-character echo CPU was 2.173 versus 2.342 ms per 100,000 calls, and single-status BEL CPU was 10.835 versus 10.897 ms per 30,000 calls. Both native terminator searches advance monotonically within the current chunk; no regex state retains the input. No scheduling, polling, provider calls, pending limits, output filtering or payload parsing changed."
      },
      "knownGaps": [
        "Live Electron input latency and Linux/Windows/WSL/SSH execution have not been measured for this parser-only change.",
        "Fragmented unterminated payload accumulation and downstream processing of large status arrays remain outside this complete-burst search budget.",
        "The one-character echo search-count fixture, the 200-BEL-frames-before-distant-ST fixture and the split-frame indexOf growth suite were removed during the test audit. Their dedicated search-count, distant-terminator and fragmented-growth alarms are relinquished; no replacement equivalence or obligation closure is claimed.",
        "Audit1287 removes the mixed-terminator/malformed-frame example from agent-status-osc.test.ts. Its earliest mixed BEL/ST, malformed-frame removal and individual payload-offset alarms are intentionally lost. The every-split and pending-cap registrations remain; no equivalent replacement is claimed.",
        "Audit1287 retires this complete historical receipt after test removals; its old counts/results do not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-status-osc.test.ts src/shared/agent-status-osc-scan-budget.test.ts src/shared/agent-status-types.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-main-side-effect-authority.test.ts src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 23.96,\n          \"summary\": \"153 tests passed across eight files. Independent baseline differential review also matched 3,704 streams and 45,141 chunk results.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-scan-budget.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\"\n        }",
        "The stricter test-value policy removes agent-status-osc-scan-budget.test.ts entirely. Its primitive String/RegExp search-work budgets and legacy RegExp.input retention alarm are intentionally lost. Current parser correctness fixtures are not equivalent search-budget or retention coverage; no new performance, runtime, platform or mobile evidence is claimed. The complete dated153-test receipt was already archived verbatim by Audit1287 and does not validate the shortened selector. A fresh parent execution is needed for current survivor coverage.",
        "Audit1318: src/shared/agent-status/contracts/agent-status-types.test.ts: Schema/field/truncation/enum inventories and JSON.parse call counts characterize status normalization over supplied values. Intentionally lose oversized question validity, Unicode surrogate clipping, stale-field rejection, freshness and dispatch-marker parsing alarms; no producer delivery or rendered interaction and no equivalent replacement. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 16.49,\n          \"summary\": \"Test Files  6 passed (6); Tests  171 passed (171). Fixture correctness only; no timing, work-count or retained-heap conclusion.\"\n        }",
        "Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/agent-status/transport/agent-status-osc.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-status/transport/agent-status-osc.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\",\n          \"durationSeconds\": 14.36,\n          \"summary\": \"Test Files  5 passed (5); Tests  154 passed (154). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/shared/agent-status/transport/agent-status-osc.test.ts\",\n    \"assertions\": [\n      \"preserves every split of prefixes, JSON, and both terminators across independent streams\",\n      \"applies the pending cap only to incomplete frames\"\n    ]\n  }\n]",
        "Retired selector metadata during audit1345; historical selector record preserved unchanged: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-status/transport/agent-status-osc.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\"],\"testFiles\":[\"src/shared/agent-status/transport/agent-status-osc.test.ts\",\"src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts\"],\"assertionRefs\":[]}"
      ],
      "promotionCriteria": [
        "Complete CI soak while preserving byte fidelity and deterministic search budgets."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate output, offset, carry or search-budget failures without relaxing the oracle."
    },
    {
      "id": "workspace-performance.ai-vault-title-input-guard",
      "title": "Title synchronization skips unchanged session collections on live heartbeats",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-unit",
      "surfaces": ["workspace title synchronization", "terminal heartbeat store subscribers"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/lib/ai-vault-tab-title-sync-inputs.ts"
      ],
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: Initial local validation; no CI soak history."
      },
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity or resource-count assertions.",
      "coverageNotes": "Audit2365 further reduces the supporting renderer agent-status suites. It removes the title-batch publication bound and generated-title sample, ordered acceptance/publication and nested/reentrant scheduling ledgers, Jcode manually assembled session-start sample, freshness-tick epoch example, repeated quit-capture identity and batched-clear examples, and sequential/batch retained-cap examples. Those alarms are no longer present; the following historical account must not be read as current coverage for them. No equivalent replacement or fresh execution evidence is claimed. Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Actual title-sync subscriber and Zustand publications are covered on macOS. Existing fixtures include SSH/runtime owner invalidation and folder workspaces; no live remote transport was launched. The guard has no platform branches, remote execution, liveness verdict or wire change. The test-value audit retires sequential/batch same-reducer replay, isolated capture-field examples, provider permutations and mock scheduling ledgers from the supporting renderer suites. The title batch publication bound remains, as do checkpoint precedence and real shutdown capture checks. This supplies no replacement evidence for the retired alarms; historical executed commands, counts and results remain historical. The test-value audit also retires isolated freshness-epoch, timestamp/attribution-copy, suppressor/reference and retained below-cap/overwrite examples from agent-status.test.ts. The original title-sync assertion references remain; retained stale-snapshot, cleanup and hard-bound checks are not equivalent replacements for these lost alarms. Historical commands, counts and results remain historical. Audit1400: src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts reduced. Loses one scan/count registration; retains owner invalidation and actual stale-reference release. No equivalent replacement coverage is claimed. Audit3146 incorporates source3132: seven authored/nine expanded provider-session lifecycle and shutdown examples are deliberately retired without replacement, including completed-session remote/manual-shutdown promotion and quit/done precedence over heartbeat. Captured-record conditional replacement and clockless Codex owner/root turn-fact isolation remain; they do not replace these alarms or establish actual shutdown/resume coverage.",
      "invariant": "Title-sync publications must not enumerate unchanged session collections, while title identity, provider availability, active pane, stored title and effective execution-host changes retain their previous invalidation decisions.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Fifty live heartbeat publications with 500 retained and 500 sleeping records cause zero unchanged-map enumerations and no extra scheduled reconciliations. Provider identity, additions/removals, agent/pane ownership, effective host, active pane and stored title changes still invalidate.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: The actual subscriber regression fails baseline with 200 unchanged-map enumerations and passes with zero. Frozen source differential matched 13,002 decisions over 6,501 transitions. Four actual producer checks passed against deeply frozen inputs."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: Actual bundled production title subscriber plus Zustand, CPU per 1,000 writes, baseline to candidate: 25 live/100 retained/100 sleeping 41.642 to 0.699 ms; 100/500/500 251.076 to 5.350 ms; 500/500/500 343.025 to 59.897 ms. Zero extra title reads or schedules. Only same-reference collections skip comparisons; no new allocation, cache, timer, IO or scheduling."
      },
      "knownGaps": [
        "No launched Electron/native-focus latency test or live external title lookup.",
        "No live SSH/WSL/Linux/Windows session; production heartbeat incidence and whole-renderer latency are not established by the fixture.",
        "The test-value audit retires sequential/batch same-reducer replay, isolated capture-field examples, provider permutations and mock scheduling ledgers from the supporting renderer suites. The title batch publication bound remains, as do checkpoint precedence and real shutdown capture checks. This supplies no replacement evidence for the retired alarms; historical executed commands, counts and results remain historical.",
        "The test-value audit also retires isolated freshness-epoch, timestamp/attribution-copy, suppressor/reference and retained below-cap/overwrite examples from agent-status.test.ts. The original title-sync assertion references remain; retained stale-snapshot, cleanup and hard-bound checks are not equivalent replacements for these lost alarms. Historical commands, counts and results remain historical.",
        "Audit1400: src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts reduced. Loses one scan/count registration; retains owner invalidation and actual stale-reference release. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-09\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/renderer/src/store/slices/agent-status-batch.test.ts src/renderer/src/store/slices/agent-status-provider-session.test.ts src/renderer/src/store/slices/agent-status.test.ts src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/renderer/src/store/slices/agent-status/agent-status-batch.test.ts src/renderer/src/store/slices/agent-status/agent-status-provider-session.test.ts src/renderer/src/store/slices/agent-status/agent-status.test.ts src/renderer/src/store/slices/agent-status/agent-status-manual-sleep-capture.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.8954373749999998,\n          \"summary\": \"The current retained gate command passed 82 tests across 6 files. Historical pre-consolidation receipts are preserved verbatim with their originally executed commands: [{\\\"date\\\":\\\"2026-09-07\\\",\\\"runner\\\":\\\"local\\\",\\\"platform\\\":\\\"macos\\\",\\\"command\\\":\\\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/renderer/src/store/slices/agent-status-batch.test.ts src/renderer/src/store/slices/agent-status-provider-session.test.ts src/renderer/src/store/slices/agent-status-retained-leak.test.ts src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts\\\",\\\"result\\\":\\\"passed\\\",\\\"durationSeconds\\\":5.35,\\\"summary\\\":\\\"69 tests passed across six files, including actual subscriber scheduling and producer identity contracts.\\\"}] No new E2E or hosted run is claimed.\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts\",\n    \"assertions\": [\n      \"does not enumerate unchanged retained and sleeping maps during live status writes\",\n      \"still detects provider changes in %s with other maps reused\",\n      \"still checks workspace ownership after unchanged record collections\",\n      \"still checks active panes and stored titles after unchanged record collections\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts\",\n          \"assertions\": [\n            \"does not enumerate unchanged retained and sleeping maps during live status writes\",\n            \"still detects provider changes in %s with other maps reused\",\n            \"still checks workspace ownership after unchanged record collections\",\n            \"still checks active panes and stored titles after unchanged record collections\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/renderer/src/store/slices/agent-status/agent-status-batch.test.ts src/renderer/src/store/slices/agent-status/agent-status-provider-session.test.ts src/renderer/src/store/slices/agent-status/agent-status.test.ts src/renderer/src/store/slices/agent-status/agent-status-manual-sleep-capture.test.ts\"],\"testFiles\":[\"src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts\",\"src/renderer/src/lib/ai-vault-tab-title-sync.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-status-batch.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-status-provider-session.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-status.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-status-manual-sleep-capture.test.ts\"]}",
        "Audit2365 further reduces the supporting renderer agent-status suites. It removes the title-batch publication bound and generated-title sample, ordered acceptance/publication and nested/reentrant scheduling ledgers, Jcode manually assembled session-start sample, freshness-tick epoch example, repeated quit-capture identity and batched-clear examples, and sequential/batch retained-cap examples. Those alarms are no longer present; the following historical account must not be read as current coverage for them. No equivalent replacement or fresh execution evidence is claimed.",
        "Renderer direct-owner cleanup retires the complete ai-vault-tab-title-sync suite (seven registrations), already referenced only by dormant historical metadata in this gate. Lost alarms: recovered sleeping-title retention, legacy title-kind precedence, host-name versus late-client precedence, provider identity invalidation, per-host batching concurrency/serialization, transcript-path retry, and failed-refresh pacing/name preservation. Real-clock polling or exact internal timer scheduling caused whole-case cuts. Freshness retains its complete queued closed-tab admission case at the public batch callback boundary; its hardcoded delivered-request count is not an internal work budget. No replacement, fresh execution, transport/native UI, provider, measured performance or cross-platform claim. Existing historical entries remain unchanged."
      ]
    },
    {
      "id": "terminal-performance.status-heartbeat-projection-budget",
      "title": "Unchanged status heartbeats reuse the aggregate workspace projection",
      "maturity": "experimental",
      "protection": "none",
      "owner": "workspace-runtime",
      "layer": "shared-and-renderer-unit",
      "surfaces": ["desktop runtime graph subscriber", "terminal status heartbeat projection"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1301 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: The always-mounted desktop subscriber uses the reviewed pure projection/cache resource path and graph-sync contracts; this gate does not independently prove every serialized field reaches a mobile recipient. All providers use the same serialized fields. WSL, platform launch, liveness, transport and mobile rendering are unaffected. The heartbeat join-count assertions were removed; the remaining projection resource checks do not replace those alarms. The broad sync-runtime-graph suite and the standalone entry-reference sort-reuse example were removed. Draft hashing, localeCompare avoidance and changed-entry/browser serialization checks remain; they do not replace the removed join, heartbeat, projection-field or broad graph alarms. Audit1301: src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts removed. Typing/hash/serialization workload, projection sort parity and draft alias snapshots lose their alarms. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts"
      ],
      "invariant": "The desktop agent-status comparison projection remains identical for every serialized field, key membership and freshness bucket while avoiding a full aggregate join when per-entry serialized content is unchanged.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1301 retired changed-source receipts. Historical oracle account: The retained resource checks exercise draft hashing, localeCompare avoidance with equivalent serialized entries, and changed open-file/browser serialization work. The join-count suite was removed as implementation-specific coverage; this gate no longer asserts entry-reference join/sort reuse or same-bucket heartbeat join suppression and invalidation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1301 retired changed-source receipts; reduced selector has no new soak result. Historical account: Initial local validation; no CI soak history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1301 changed referenced test sources; no new red/green validation. Historical account: Historical evidence from the removed heartbeat fixture: The new heartbeat fixture failed on baseline with 50 aggregate joins; candidate performs zero and still invalidates on the next freshness bucket and new assistant detail. That fixture is no longer retained; no equivalent current regression coverage is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1301 changed test sources; no new measurement. Previous account: Historical measurement: 50 redundant aggregate joins fall to zero. Paired production projection/equality benchmark: 500 agents with 8 KB previews improves 1.716 to 0.089 ms/update; 1000 improves 3.601 to 0.123 ms/update. Avoids rebuilding 5.06/10.11 million-character aggregate strings. Entry serialization and sorting remain bounded by the current status map; no new cache, polling or asynchronous work. The removed join-count assertions no longer enforce that behavior."
      },
      "knownGaps": [
        "Measured production projection self-time excludes store updates and rendering; no whole-app input-latency claim.",
        "Native platforms, live SSH/relay and older clients were not launched. This changes only equality-preserving cache reuse, with no wire or persisted schema change.",
        "Entry-reference join/sort reuse, same-bucket heartbeat join suppression, and bucket/detail invalidation alarms were intentionally removed with the implementation-specific suite.",
        "The broad sync-runtime-graph suite and the standalone entry-reference sort-reuse example were removed. Draft hashing, localeCompare avoidance and changed-entry/browser serialization checks remain; they do not replace the removed join, heartbeat, projection-field or broad graph alarms.",
        "Audit1301: src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts removed. Typing/hash/serialization workload, projection sort parity and draft alias snapshots lose their alarms. No equivalent replacement coverage is claimed.",
        "Audit1301 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/runtime/sync-runtime-graph-agent-status-projection-join.test.ts src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts src/renderer/src/runtime/sync-runtime-graph.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts\",\n          \"result\": \"passed\",\n          \"summary\": \"38 tests passed across four projection and graph-sync files; renderer typecheck passed.\",\n          \"durationSeconds\": 2.7\n        }",
        "Audit1301 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts\",\n    \"assertions\": [\n      \"constructs no ICU collator, and keeps the same entries as the localeCompare order\"\n    ]\n  }\n]"
      ],
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity, liveness or resource-count assertions."
    },
    {
      "id": "terminal-performance.partial-escape-ground-scan",
      "title": "Terminal snapshots preserve partial escapes with bounded ground-state scan work",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "shared-and-daemon-unit",
      "surfaces": ["headless terminal output ingestion", "terminal snapshot continuity"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Shared parser, production emulator and Session contracts cover local/daemon paths; remote snapshot semantics use the existing corruption reproduction without live transport. The scanner has no workspace or host branching; folder/git workspaces, WSL, mobile/relay and platform execution/wire boundaries are unchanged. Audit1356 removes the two remote-snapshot mouse-reset cases: their test-owned replay helper appends the production reset constant and cannot catch an actual consumer omitting reset. Their mode-serialization/reset alarms are intentionally lost. The split escape-tail serialization and xterm continuation case remains, with no live remote transport claim. The complete prior mixed 15-test receipt is historical and cannot validate this reduced source; fresh validation remains required. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/7329"],
      "invariant": "Partial escape tracking preserves exact pending UTF-16 and completion across chunk/snapshot boundaries while skipping ordinary ground-state text without a JavaScript per-code-unit walk.",
      "oracle": "Colored ASCII and UTF-16 output retains the exact incomplete CSI tail using fewer than 32 code-unit inspections. Every split of CSI/OSC/DCS/ESC-intermediate controls and CAN/SUB/ESC aborts preserve completion; one-character echo performs zero inspections or native ESC searches. Seeded headless snapshot restore matches a renderer terminal twin.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Focused unit/provider-contract suite; local runtime budget, not an established p95."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Initial local validation; no CI soak history."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "New ASCII/UTF-16 work budgets failed baseline at 262,160/196,624 inspected code units; candidate inspects 16 code units and 2 native ESC searches in each with exact tails and completion. External differential matched 2,710,126 cases (plus 388,416 hybrid-vs-baseline cases over the full VT alphabet with lone/split surrogates, 0 mismatches); existing fold fuzz covers 593,468 cases."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Production HeadlessEmulator.writeSync CPU for 2 MiB colored logs improves 32.321 to 26.638 ms; sparse ANSI improves 26.757 to 21.982 ms. Agent-redraw CPU improves 402.308 to 394.633 ms. Rotated 100,000-write baseline/identical-control/candidate medians: plain echo 27.340/27.015/27.822 ms, colored echo 36.009/35.556/35.981 ms. Native ESC searches advance only in ground, and only when the current code unit is not already ESC, so dense back-to-back CSI streams do not pay a search per sequence: 0.9 MiB dense SGR/CSI medians are 2.04 ms baseline, 2.56 ms search-always, 1.92 ms shipped. Existing plain-output fast path is unchanged. No new state, allocation, timer, provider call or transport behavior."
      },
      "knownGaps": [
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No launched Electron or live SSH/WSL/Windows/Linux process, native input or end-to-end UI-latency measurement.",
        "Existing 4,096-code-unit tracking abandonment and idle-death partial-tail behavior are unchanged.",
        "Audit1356 removes the two remote-snapshot mouse-reset cases: their test-owned replay helper appends the production reset constant and cannot catch an actual consumer omitting reset. Their mode-serialization/reset alarms are intentionally lost. The split escape-tail serialization and xterm continuation case remains, with no live remote transport claim. The complete prior mixed 15-test receipt is historical and cannot validate this reduced source; fresh validation remains required.",
        "Audit1365 retires this complete dated receipt because its selector includes a deleted or reduced source. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-7329-remote-snapshot-corruption.test.ts src/main/daemon/session-shell-recovery.test.ts src/main/daemon/headless-emulator-fidelity.fuzz.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 36.24,\n          \"summary\": \"15 tests passed across three files including 300 headless-to-renderer snapshot fidelity streams.\"\n        }",
        "Audit1365 historical provider claim before source reduction: [\"local\",\"daemon\",\"ssh\",\"remote-runtime\"]. Remaining unchanged-source receipts do not explicitly map provider execution; coveredProviders is cleared."
      ],
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity, liveness or resource-count assertions."
    },
    {
      "id": "terminal-performance.pending-control-storage",
      "title": "Pending terminal controls release consumed output backing storage",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "shared-and-renderer-unit",
      "surfaces": [
        "terminal output ingestion",
        "pending agent status frames",
        "terminal preview normalization",
        "terminal title tracking"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": [],
      "coverageNotes": "Audit1853 validates 18 retained cases from the five-file selector on Linux within one six-file parent support run: 24 total cases passed, including six independent sequencer cases. The 1.017-second duration belongs to the complete composite command, not the five-file subset. No new soak, p95, provider or cross-platform proof, per-site ownership-spy coverage, or replacement equivalence is claimed. Historical pre-Audit1853 coverage account (not a current result for the reduced suite): Audit1496 deletes terminal-tail-whitespace.test.ts: the wall-clock padded redraw smoke is intentionally retired, including its quadratic-whitespace alarm. No equivalent replacement or fresh physical-provider/budget evidence is claimed. Shared primitive and status/title parser tests cover provider-independent string behavior on macOS. The status pending-storage suite now retains only its raw UTF-16 parser fixture; its site ownership spy, large-chunk replay and segmented pending-cap fixture were removed. The removed terminal normalizer suite has no replacement-equivalence claim. Native execution, process ownership, wire formats and mobile UI were not validated by this audit. Audit1287 removes the mixed-terminator/malformed-frame example from agent-status-osc.test.ts. Its earliest mixed BEL/ST, malformed-frame removal and individual payload-offset alarms are intentionally lost. The every-split and pending-cap registrations remain; no equivalent replacement is claimed. Audit1313: src/main/runtime/terminal-tail-buffer.test.ts: Random warm/cold comparisons use the same production function as oracle; remaining case counts String.prototype charCodeAt against a private work threshold. Lose cache-total equivalence and prefix-work alarm without replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/agent-status/contracts/agent-status-types.test.ts: Schema/field/truncation/enum inventories and JSON.parse call counts characterize status normalization over supplied values. Intentionally lose oversized question validity, Unicode surrogate clipping, stale-field rejection, freshness and dispatch-marker parsing alarms; no producer delivery or rendered interaction and no equivalent replacement. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1496 validates the five remaining sources locally on Linux:20 tests pass; no provider execution mapping or padded redraw-budget claim.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/shared/agent-status/transport/agent-status-osc.test.ts"
      ],
      "invariant": "Small incomplete status, ANSI and title controls must not retain the larger consumed output strings they were sliced from. Every retained control fragment is routed through ownRetainedString, which preserves exact UTF-16, current caps and trimming, payload order and clean-output offsets on both the Buffer and the code-unit fallback copier.",
      "oracle": "The retained primitive forced-GC fixture checks parent backing-storage release, exact UTF-16 cases check both copy paths, and status/title parsers check their retained fidelity/cap and non-title exclusion cases. No retained status-site, title-site or terminal-normalizer ownership spy establishes per-site backing-storage retention. Primitive memory/fidelity checks are not equivalent replacements for removed site spies, title-prefix inventories or short-copy-threshold examples. The fresh Linux composite run validates 18 gate cases plus six unrelated sequencer cases; it establishes no new provider, native renderer/mobile, soak or p95 result.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts"
      ],
      "testFiles": [
        "src/shared/own-retained-string.test.ts",
        "src/shared/agent-status/transport/agent-status-osc.test.ts",
        "src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts",
        "src/shared/osc-title-scan-tail-retention.test.ts",
        "src/shared/osc-title-scan-tail.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/shared/own-retained-string.test.ts",
          "assertions": [
            "releases the parent chunk that a retained tail was sliced from",
            "round-trips %s exactly",
            "matches the block copier when Buffer is unavailable"
          ]
        },
        {
          "file": "src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts",
          "assertions": ["preserves raw UTF-16 across an owned suffix and %j"]
        },
        {
          "file": "src/shared/osc-title-scan-tail-retention.test.ts",
          "assertions": [
            "preserves title %s introducer and exact UTF-16 at the cap",
            "keeps trimming an owned title that grows past the cap"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-11-07",
          "runner": "local",
          "platform": "linux",
          "result": "passed",
          "command": "/home/neil/.local/share/mise/installs/node/24.22.0/bin/node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1413-parent-runtime/validation/node_modules/vitest/vitest.mjs run --config config/vitest.config.ts config/scripts/ci/sharding/ci-unit-sequencer.test.mjs src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts --maxWorkers=2 --reporter=default --reporter=json --outputFile=/home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1853-combined-value-review/support-runtime/vitest.json",
          "currentCommand": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts",
          "durationSeconds": 1.017,
          "summary": "Audit1853 parent support composite run passed 24 cases across six files: 18 retained gate cases in the five currentCommand sources and six ci-unit-sequencer cases. The recorded command and duration describe the full six-file run. Single local execution; no new p95, soak, provider, native renderer/mobile or cross-platform result, no fresh numerical heap/microbenchmark result and no replacement-equivalence claim. Artifacts: audit1853-combined-value-review/support-runtime/vitest.json and support-runtime-result.json."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Single Linux composite unit run: 24 passed across six files in 1.017 seconds; 18 cases belong to this five-file gate and six to the sequencer. Duration is for the full composite command. The historical 60-second p95 target is unchanged and unmeasured; no new soak or physical-provider budget conclusion."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "One local Linux composite run passed the 18 retained gate cases and six sequencer cases. No new CI soak history or repeated-run flake conclusion. The forced-GC primitive fixture remains experimental; removed per-site deterministic spies supply no current evidence. Historical pre-audit account: Initial local validation; no CI soak history. Only one fixture depends on forced GC; the three per-site retention checks are deterministic spy assertions."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "No fresh mutant/red-green validation of the reduced selector. Historical pre-audit observations only, including the removed site-spy and differential-fixture observations; they do not validate current per-site retention coverage: The primitive fixture measures 32.00 MB retained for plain slices against 1.13 MB owned, so its 16 MiB/4 MiB bounds fail without ownership. Removing ownRetainedString from terminal-ansi-normalization.ts reproducibly fails 'routes every retained pending control through ownRetainedString' while the ten fidelity cases still pass, confirming the spy assertions carry the retention contract rather than the fidelity ones. Exact-output equivalence against the pre-change parsers was re-checked in the differential fixtures: byte-exact clean output, trimmed tails, payload order and clean offsets are unchanged."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical pre-audit microbenchmarks and implementation observations only; no fresh performance, p95, provider or platform measurement is supplied by Audit1853: ownRetainedString is a Buffer utf16le round trip, measured at 0.57 us for 4 Ki code units and 21.9 us for 64 Ki, against 10.0 us and 170.3 us for the code-unit block copier it replaces (min of 12 rounds x 500, isolated processes). Strings below V8 SlicedString::kMinLength (13) are returned unchanged. Interleaved min-of-15 comparisons against the un-owned parsers: 16 Ki-char ANSI chunks with a 4 Ki tail 48.7 to 50.1 us/chunk (+2.8%); 4 Ki-char ANSI chunks with a 2 Ki tail 14.7 to 12.9 us/chunk (-12.0%); 194 Ki-char status chunks with a 64 Ki pending frame 298.1 to 360.5 us/chunk (+21.0%). Ordinary streams with no pending control never call the primitive. Plain-output paths, scheduling, provider calls, limits and trimming are unchanged."
      },
      "knownGaps": [
        "No live Electron input-latency or Linux/Windows/WSL/SSH execution measurement; exact string and tail behavior is covered on macOS.",
        "The primitive's GC fixture is experimental with no CI soak. A provider input already sliced from an unseen larger ancestor can retain that ancestor; no universal heap cap or whole-process memory reduction is claimed.",
        "The renderer and mobile fallback copier is covered by a Buffer-free equivalence test, not by a real renderer bundle run.",
        "The terminal normalizer per-site ownership spy and ANSI fidelity suite was removed; historical evidence runs and red-green observations below remain historical only.",
        "Tail-buffer row retention is a larger instance of the same pattern and is not covered by this gate.",
        "The status-site ownRetainedString spy, large-chunk byte-exact replay and segmented at-cap/over-cap fixture were removed during the test audit. The old assertion reference drops an owned frame that grows past the pending cap was already stale and is removed too. Status-site retention and these dedicated large-replay/cap alarms are no longer established by this suite; raw UTF-16 fidelity and primitive memory checks are not equivalent replacements. No obligation closure or waiver of historical budgets is claimed.",
        "Audit1287 removes the mixed-terminator/malformed-frame example from agent-status-osc.test.ts. Its earliest mixed BEL/ST, malformed-frame removal and individual payload-offset alarms are intentionally lost. The every-split and pending-cap registrations remain; no equivalent replacement is claimed.",
        "Audit1287 retires this complete historical receipt after test removals; its old counts/results do not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status-osc.test.ts src/shared/agent-status-osc-pending-retention.test.ts src/shared/agent-status-types.test.ts src/main/runtime/terminal-ansi-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 11.4,\n          \"summary\": \"114 tests passed across nine primitive, parser, payload, normalization, title and terminal-buffer files.\"\n        }",
        "Audit1313: src/main/runtime/terminal-tail-buffer.test.ts: Random warm/cold comparisons use the same production function as oracle; remaining case counts String.prototype charCodeAt against a private work threshold. Lose cache-total equivalence and prefix-work alarm without replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1313 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.64,\n          \"summary\": \"Test Files  8 passed (8); Tests  48 passed (48). Fixture correctness only; no timing, work-count or retained-heap conclusion.\"\n        }",
        "Audit1318: src/shared/agent-status/contracts/agent-status-types.test.ts: Schema/field/truncation/enum inventories and JSON.parse call counts characterize status normalization over supplied values. Intentionally lose oversized question validity, Unicode surrogate clipping, stale-field rejection, freshness and dispatch-marker parsing alarms; no producer delivery or rendered interaction and no equivalent replacement. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/terminal-tail-whitespace.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.64,\n          \"summary\": \"Test Files  8 passed (8); Tests  48 passed (48). Fixture correctness only; no timing, work-count or retained-heap conclusion.\"\n        }",
        "Retired during audit1319 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-whitespace.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/agent-status/contracts/agent-status-types.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-whitespace.test.ts\",\"durationSeconds\":3.39,\"summary\":\"Test Files  7 passed (7); Tests  39 passed (39). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 574edb34b8e5448541e7a69aac098958d91ffb06.\"}",
        "Audit1496 deletes terminal-tail-whitespace.test.ts: the wall-clock padded redraw smoke is intentionally retired, including its quadratic-whitespace alarm. No equivalent replacement or fresh physical-provider/budget evidence is claimed.",
        "Audit1496 retires this complete historical receipt after selector deletion; it does not validate the reduced selector. Original receipt verbatim:\n{\n  \"date\": \"2026-11-04\",\n  \"runner\": \"local\",\n  \"platform\": \"linux\",\n  \"result\": \"passed\",\n  \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal-tail-whitespace.test.ts --maxWorkers=2\",\n  \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts src/main/runtime/terminal/output/tail/terminal-tail-whitespace.test.ts\",\n  \"durationSeconds\": 3.6,\n  \"summary\": \"Test Files  6 passed (6); Tests  22 passed (22). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"\n}",
        "Audit1496 previous mixed selector platform/provider claims are historical only: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"remote-runtime\"]}",
        "Audit1853 retires this complete dated receipt because its selector includes reduced test sources. Its historical result, count and duration do not validate the reduced selector or equivalent coverage. Original receipt verbatim:\n{\n          \"date\": \"2026-11-05\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 /home/neil/.local/share/mise/installs/node/24.22.0/bin/node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts --maxWorkers=2 --reporter=default --reporter=json --outputFile=/home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1496-renderer-next/runtime-batch/gate-validation-attempts/1793882954439602905/vitest.json\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/own-retained-string.test.ts src/shared/agent-status/transport/agent-status-osc.test.ts src/shared/agent-status/transport/agent-status-osc-pending-retention.test.ts src/shared/osc-title-scan-tail-retention.test.ts src/shared/osc-title-scan-tail.test.ts\",\n          \"durationSeconds\": 1.416,\n          \"summary\": \"20 tests pass across the five remaining sources on an isolated display. Native adapters remain mocked where present. Single local execution; no p95, cross-platform/provider or padded-redraw-work conclusion. Audit1496 candidate based on6e91427ee70d3118d5b78343f16a22d2bd3255e1.\"\n        }",
        "Audit1853 accepts removal of the ordinary incomplete OSC-title-prefix inventory and short-string copy-threshold examples. Three already-stale assertion references are removed: leaves already-flat short strings alone; routes every retained title tail through ownRetainedString; keeps %i-character chunks with %i incomplete titles byte-exact. The title-site ownership spy and large-chunk replay are not current alarms; retained primitive heap/fidelity and parser cases are not equivalent replacements. No new soak, p95, provider or cross-platform proof is claimed."
      ],
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity, liveness or resource-count assertions."
    },
    {
      "id": "terminal-performance.vertical-control-scan",
      "title": "Main terminal preview scanning skips ordinary output between controls",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "main-runtime-unit",
      "surfaces": ["terminal output ingestion", "terminal preview and read tails"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/.agents/skills/perf/SKILL.md"
      ],
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Initial local validation; no CI soak history."
      },
      "promotionCriteria": [
        "Complete CI soak with zero unexplained flakes and preserve the observable oracle."
      ],
      "demotionRule": "Keep experimental until CI soak; investigate failures without relaxing fidelity or resource-count assertions.",
      "coverageNotes": "Audit2168: Current retained source covers chunk-carried normalization, embedded/incomplete string-control framing and complete tail redraw semantics only; removed recognition and scan-resumption inventories accept coverage loss. Historical execution and measured performance refer to earlier bytes. Prior account preserved verbatim: Pure shared-host string semantics and main runtime tests cover the production scanner on macOS. Folder/git workspaces, local/daemon/SSH/remote-runtime authority, wire content and mobile/relay behavior are unchanged. No live native remote session was launched.",
      "invariant": "Main terminal preview/read tails choose the same append/redraw path while ordinary text is skipped without a JavaScript code-unit walk. Complete string-control payloads are not interpreted as vertical controls; incomplete controls stop at the same point.",
      "oracle": "Current retained callbacks preserve printable spans and carried controls across chunks, skip embedded CSI and stop at incomplete OSC/DCS/SOS/PM/APC strings, and verify resulting cursor-up tail redraw rows. No code-unit work budget or exhaustive parameter/final recognition matrix is asserted by this reduced source.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts"
      ],
      "testFiles": ["src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts"],
      "assertionRefs": [
        {
          "file": "src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts",
          "assertions": [
            "preserves printable spans and carried controls across chunk boundaries",
            "skips embedded CSI and stops at an incomplete %s",
            "preserves tail rows when ordinary output is followed by a cursor-up redraw"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-07",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-vertical-control-scan.test.ts",
          "result": "passed",
          "durationSeconds": 0.325,
          "summary": "29 scanner work-budget, control recognition, scan-resumption and complete-tail integration tests passed.",
          "currentCommand": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Focused scanner and tail-contract suite; local runtime budget, not an established p95."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Baseline inspections 90,112/90,119/98,307 become 0/5/2. Frozen differential matched 204,925 predicate cases and 3,000 complete tail transitions. Broader integrated validation passed 1,308 tests with one existing skip across six files. Independent original-base normalizer with only this scanner change passed 1,298 tests with one existing skip across five files (20.55 seconds), using a temporary Vite source override; this confirms independence from the pending-storage PR."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Actual normalize, append-tail, transcript and preview pipeline: 4 MiB/64 KiB-chunk CPU medians plain 43.418 to 37.932 ms, colored 49.321 to 42.570, wide 41.022 to 32.883, dense newlines 37.112 to 31.601, no-newline 32.009 to 25.100. 10,000 sequential single-character writes into a growing partial line 190.374 to 126.820 ms. Equal-bundle rotated controls show no material tiny-echo/redraw regression. Forward native ESC search skips only ground text; no new retained state, scheduling, timer or provider calls."
      },
      "knownGaps": [
        "No live end-to-end input latency, many-pane frame measurement or launched Electron/SSH/WSL/Linux/Windows journey.",
        "Existing preview fidelity and incomplete-control handling remain unchanged; broader runtime suite has one existing skipped case.",
        "Audit2168: Intentionally remove the long retained-CSI identity, exact retained-final inventory, long plain/colored/vertical boolean table, numeric/noncanonical parameter table and scan-resumption table from src/main/runtime/terminal/output/terminal-vertical-control-scan.test.ts. Retain carried-control chunk framing, embedded/incomplete OSC/DCS/SOS/PM/APC skipping and actual tail cursor-up redraw. Accepted coverage loss; retained callbacks are not equivalent replacements. The 2026-09-07 evidenceRun (including currentCommand), redGreenEvidence and performanceBudget describe historical bytes and remain verbatim; they do not validate the changed source. No fresh execution, scanner work budget, runtime latency, real provider, remote/mobile or cross-platform result is claimed."
      ]
    },
    {
      "id": "terminal-performance.padded-fullscreen-redraw",
      "title": "Fullscreen redraw padding does not stall terminal delivery",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "runtime-unit-and-electron-cdp",
      "surfaces": ["terminal transcript preview", "fullscreen TUI scrolling"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1496 deletes terminal-tail-whitespace.test.ts: the wall-clock padded redraw smoke is intentionally retired, including its quadratic-whitespace alarm. No equivalent replacement or fresh physical-provider/budget evidence is claimed. The trim operation is platform-independent and preserves the same spaces/tabs policy for all providers. Real Pi 0.84.2 was exercised in a hidden macOS Electron renderer through CDP using a folder workspace. Audit1313: src/main/runtime/terminal-tail-buffer.test.ts: Random warm/cold comparisons use the same production function as oracle; remaining case counts String.prototype charCodeAt against a private work threshold. Lose cache-total equivalence and prefix-work alarm without replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/14770"],
      "invariant": "Transcript preview trimming preserves internal whitespace and terminal read contents without quadratic main-process work on padded fullscreen redraws.",
      "oracle": "The padded-redraw whitespace timing suite and its assertion references were removed by audit1496. This gate has no current test protection. Historical timing, red-green and performance observations remain historical only; no equivalent replacement is claimed.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Three unit test files; padding cases allow 500 ms for four redraws. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Initial local red/green validation; no CI soak history yet."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Both padding budget cases fail with regex trimming and pass with the existing linear trim. A 60-event CDP wheel stream in Pi fullscreen had about 2.1 seconds of output tail before the fix and 14 ms after rebuilding."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The main CPU profile attributed 3.1 seconds to redraw-row whitespace trimming. Reusing the linear trim adds no timers, caches, provider calls, or output dropping."
      },
      "knownGaps": [
        "The user manually compared the fixed dev app with production and confirmed improved responsiveness. A live Terminal.app comparison was not exercised; timing measurements used CDP wheel events.",
        "Linux, Windows, and live SSH rendering were not exercised; the shared trimming behavior is covered by unit tests.",
        "Audit1313: src/main/runtime/terminal-tail-buffer.test.ts: Random warm/cold comparisons use the same production function as oracle; remaining case counts String.prototype charCodeAt against a private work threshold. Lose cache-total equivalence and prefix-work alarm without replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1313 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-06\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal-tail-whitespace.test.ts src/main/runtime/terminal-tail-buffer.test.ts src/main/runtime/retained-tail-redraw-window.equivalence.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.96,\n          \"summary\": \"17 tests passed. Before the fix both padding budget cases failed, taking approximately 1.7 seconds each.\"\n        }",
        "Audit1496 deletes terminal-tail-whitespace.test.ts: the wall-clock padded redraw smoke is intentionally retired, including its quadratic-whitespace alarm. No equivalent replacement or fresh physical-provider/budget evidence is claimed.",
        "Audit1496 retires this complete historical receipt after selector deletion; it does not validate the reduced selector. Original receipt verbatim:\n{\n  \"date\": \"2026-11-04\",\n  \"runner\": \"local\",\n  \"platform\": \"linux\",\n  \"result\": \"passed\",\n  \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/terminal-tail-whitespace.test.ts src/main/runtime/retained-tail-redraw-window.equivalence.test.ts --maxWorkers=2\",\n  \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/terminal/output/tail/terminal-tail-whitespace.test.ts src/main/runtime/retained-tail-redraw-window.equivalence.test.ts\",\n  \"durationSeconds\": 2.82,\n  \"summary\": \"Test Files  2 passed (2); Tests  4 passed (4). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 574edb34b8e5448541e7a69aac098958d91ffb06.\"\n}",
        "Audit1496 previous mixed selector platform/provider claims are historical only: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"daemon\"]}",
        "Audit1496 demotes protection to none after deleting the sole padded-work assertion suite. Previous remaining selector was historical context, not equivalent protection: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/retained-tail-redraw-window.equivalence.test.ts\"],\"testFiles\":[\"src/main/runtime/retained-tail-redraw-window.equivalence.test.ts\"]}",
        "Audit1959 (sources 1957:29): The complete retained-tail equivalence suite is removed because randomized expected output comes from another production implementation. The gate already has no current protection, commands, active references or receipts; preserve that status and all prior historical gap literals. Lose the equivalence alarms without replacement. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet."
      ],
      "promotionCriteria": [
        "Complete CI soak requirements and retain the padding budget and tail equivalence oracles."
      ],
      "demotionRule": "Keep experimental until CI soak is stable; investigate any budget failure without weakening transcript preservation."
    },
    {
      "id": "terminal-output.prestarted-shell-snapshot-adoption",
      "title": "Prestarted shell adoption paints covered output once",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-transport-and-live-electron",
      "surfaces": [
        "backend-created first terminal",
        "daemon snapshot adoption",
        "deferred live output"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "wsl", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3086: the transport filename selector loses IPC suspension/input/reattach cases and the entire spawn-errors suite. Unique classification, ownership, fallback retirement, reply-limit, write-failure and teardown-branch alarms are intentionally retired without replacement. Remaining registrations are unchanged; no fresh execution or real provider result is claimed. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The retained directory-level discovery command continues to discover the reduced family; historical wrapper mentions are not fresh import-closure or execution evidence. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-coalesce.test.ts: surfaces working frames when many spinner frames arrive in one chunk. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-spinner.test.ts: surfaces normalized working and idle labels across a spinner cycle; surfaces working even when a single chunk contains multiple spinner frames. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-agent-trust-hold.test.ts: spawns only after the answer, carrying \"let agents ask\" to main for this launch; reattaches a section terminal without asking or changing trust; spawns with today's default when the prompt is released without an answer. src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-ssh-hook-status-authority.spec.ts: leaves SSH IPC OSC 9999 status ownership in the main runtime. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionSshHookStatusAuthorityTests } from '../host-ownership/pty-connection-ssh-hook-status-authority.spec'; registerPtyConnectionSshHookStatusAuthorityTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-spawn-intent.test.ts: declares the intent only when the spawn resumes an agent; reports a deferral to the pane instead of an error toast. src/renderer/src/components/terminal-pane/pty-connection/startup/in-place-resume-hold.test.ts: owns the record while the start runs, through a nested start, and releases on settle; holds nothing for a start not resuming a record, or once the pane is disposed. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): The existing directory-level pnpm test selector includes eleven changed source files and automatically omits the three whole deletions. Keep this nonempty discovery command unchanged; no dated receipt uses this broad path. Removed agent admission fields, mock transport routing and terminal-id projection alarms are lost. Retained foreground state, actual headless xterm, redraw, abort/rebind reader and bridge claim progression remain scoped to their unchanged callbacks. No current-source execution, independent replacement, native transport or physical provider result is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/pty-connection/main-pane-start-wait.test.ts: Loses joined waiter invocation/failure notification and raw terminal error/paired-host readable sentence alarms; survivors preserve hold detection and card clearing. deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts: Loses typed-input forced synchronized-frame presentation alarm; setup implements the parser behavior it claims to exercise. deletes src/renderer/src/components/terminal-pane/pty-connection-unserved-ssh-pane.test.ts: Loses automatic SSH dial deduplication, passphrase gating, stale pane exclusion, and disposal cancellation alarms. deletes src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts: Loses source grid before frame and destination grid restoration ordering alarm. deletes src/renderer/src/components/terminal-pane/pty-connection-restart-replacement.spec.ts: Loses wrapper-level hidden/visible restart resume, dispose/rebind suppression and finished-turn replay alarms; manual pipeline and mock-implemented binding invalidate the whole callbacks. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1391 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1361 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): macOS daemon-backed Electron journey verifies same PID and terminal identity plus rendered output. Focused renderer contracts pass on Linux, Windows and WSL. Neighboring SSH model and replay contracts pass locally; no new live SSH or paired-runtime journey. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-unanswered-command-finish.spec.ts removed. Unanswered SSH shell finish keeps/drops mocked agent row matrix disappears. src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts reduced. Happy inherited-cwd wait and transport-option forwarding sample loses its individual alarm. src/renderer/src/components/terminal-pane/pty-connection-command-input-agent-identity.spec.ts removed. Typed Droid versus process/launch identity and SSH/runtime process-evidence matrices disappear. src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts removed. Success/no-ID/expired/superseded attach-settlement bag alarms disappear. src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts reduced. Every-write kind forwarding and synchronous driving-attempt observer/rejection/ACK call counts disappear. src/renderer/src/components/terminal-pane/pty-connection-codex-restart-input-lookup.spec.ts removed. No global tab enumeration on ordinary/stale input and known restart notice input-block mock-call alarms. src/renderer/src/components/terminal-pane/pty-connection-layout-owner-wake.test.ts removed. Hidden-to-visible single-pane start request, attach-only argument and negative local wake-record alarms are intentionally dropped; no real server wake/ack occurs. src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1361: src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts reduced. Internal searched-character budget and ordinary/malformed no-op controls. No equivalent replacement coverage is claimed. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim. Audit1369: src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts removed. Rootless/removed/moved tabs, missing leaves, queued deletion and host-qualified/legacy deletion eligibility fixtures. No equivalent replacement coverage is claimed. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/renderer/src/components/terminal-pane/pty-connection/terminal-input-echo-delay.test.ts reduced. Removes two fabricated-binding pipeline registrations; retains timestamp-policy outcomes without wall-clock speed assertions. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. src/renderer/src/components/terminal-pane/pty-connection/main-pane-resume-banner.test.ts reduced. Loses subscription-budget and attach-start generation predicate alarms; actual restored-banner renderer is not exercised. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.",
      "motivatingLinks": [
        "https://github.com/user-attachments/assets/e8c6d1dc-6150-4c3d-b55a-3d12efefdd04",
        "https://github.com/user-attachments/assets/b0328f88-34ac-4d51-8119-9efe17072435"
      ],
      "invariant": "Adopting a prestarted terminal preserves its existing process and paints snapshot-covered startup output once while retaining subsequent live output. Missing sequence proof or blank snapshots must not authorize dropping output.",
      "oracle": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3086: the transport filename selector loses IPC suspension/input/reattach cases and the entire spawn-errors suite. Unique classification, ownership, fallback retirement, reply-limit, write-failure and teardown-branch alarms are intentionally retired without replacement. Remaining registrations are unchanged; no fresh execution or real provider result is claimed. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The retained directory-level discovery command continues to discover the reduced family; historical wrapper mentions are not fresh import-closure or execution evidence. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-coalesce.test.ts: surfaces working frames when many spinner frames arrive in one chunk. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-spinner.test.ts: surfaces normalized working and idle labels across a spinner cycle; surfaces working even when a single chunk contains multiple spinner frames. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-agent-trust-hold.test.ts: spawns only after the answer, carrying \"let agents ask\" to main for this launch; reattaches a section terminal without asking or changing trust; spawns with today's default when the prompt is released without an answer. src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-ssh-hook-status-authority.spec.ts: leaves SSH IPC OSC 9999 status ownership in the main runtime. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionSshHookStatusAuthorityTests } from '../host-ownership/pty-connection-ssh-hook-status-authority.spec'; registerPtyConnectionSshHookStatusAuthorityTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-spawn-intent.test.ts: declares the intent only when the spawn resumes an agent; reports a deferral to the pane instead of an error toast. src/renderer/src/components/terminal-pane/pty-connection/startup/in-place-resume-hold.test.ts: owns the record while the start runs, through a nested start, and releases on settle; holds nothing for a start not resuming a record, or once the pane is disposed. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): The existing directory-level pnpm test selector includes eleven changed source files and automatically omits the three whole deletions. Keep this nonempty discovery command unchanged; no dated receipt uses this broad path. Removed agent admission fields, mock transport routing and terminal-id projection alarms are lost. Retained foreground state, actual headless xterm, redraw, abort/rebind reader and bridge claim progression remain scoped to their unchanged callbacks. No current-source execution, independent replacement, native transport or physical provider result is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Pass snapshot sequence and proven zero keyboard flags through real IPC transport projection. Deliver snapshot-covered and newer output before reattach resolves; drain replay parse callbacks and require one startup marker and the newer output. Repeat with no sequence and blank snapshot to retain unproven bytes. In Electron select a prestarted workspace, type a generated marker and compare PID and stable terminal identities before and after.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1391; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1361; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: Focused local and remote runs pass; no CI soak history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1391 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1361 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Metadata tests fail before forwarding. Corrected parse-draining regression observes two startup markers when the baseline installation is removed, and one after restoration. Initial missing-live-output failure was a harness parse-drain omission and is not red proof. Before/fixed Electron screenshots show duplicate/single startup output."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Reuses existing snapshot baseline reconciliation with no new scan, timer or subprocess. Corrected daemon-backed rendered trial reaches replay at 116.6 ms and generated keyboard output at 177 ms after selecting the prestarted workspace. This measures selection/adoption, not ordinary composer creation."
      },
      "promotionCriteria": [
        "Meet manifest CI and soak policy.",
        "Retain intentional-break and rendered identity/output proof.",
        "Exercise live SSH and paired-runtime snapshot adoption before claiming full provider coverage."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode-2031-subscriptions.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/geometry/pty-connection-visibility-resume-size.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/geometry/remote-reconnect-unimaged-pane-redraw.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-restore-fit-overflow.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-restore-flood-abandon.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-restore-unhide-repaint-fallback.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/remote-hidden-output-restore-outcomes.test.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-stale-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/pty-connection-split-spawn.spec.ts. Intentionally lose these named regression alarms without replacement: catches a subscribed pane up once per mode change across repeated reconnects — Mode2031 theme reporting catch-up/deduplication across repeated reconnects loses this direct protocol example.; defers to the viewer holding the grid, then catches up once on release — Held-grid viewer deferral and one catch-up/current-mode resending on release lose this direct protocol example.; repairs grid drift with a trailing probe when output stops inside the settled interval — A trailing drift probe after the last output frame loses this direct alarm.; skips foreground grid drift repair while mobile owns the PTY without a fit override — Mobile driver ownership suppressing foreground drift repair without override loses this direct alarm.; reports desktop geometry without resizing while a mobile-fit override is active — Desktop geometry reporting without resizing a mobile-owned grid loses this direct alarm.; defers a remote-desktop viewport claim until structural replay completes — Remote-desktop viewport claim waiting for structural replay completion loses this direct alarm.; skips observed desktop reassertion while mobile owns the PTY without a fit override — Observed desktop reassertion suppression under mobile ownership loses this direct alarm.; queues re-asserted resizes while pane resize holds are active — Resize hold release flushing the latest reasserted grid loses this direct alarm.; reasserts a remote grid only when visible (%s) — Visible-only remote grid reassertion loses its visible and hidden examples.; claims a focused visible remote mirror once when its passive fit hold arrives — Focused visible passive mirror claiming once, with unfocused and late repeat suppression, loses this direct sequence alarm.; does NOT re-assert while a mobile-fit override parks the PTY at phone dims — Phone fit hold suppressing visibility-resume PTY reassertion loses this direct alarm.; does NOT forward when the pane is hidden again before getSize resolves (stale hop) — Late size lookup after re-hide refusing a hidden-tab SIGWINCH loses this direct adverse-ordering alarm.; holds the repaint for a hidden pane until it is revealed — Unimaged hidden pane deferring one-row repaint until reveal loses this direct alarm.; puts the row back once the host confirms the short grid, not when the client sent it — Short-grid host confirmation gating row restoration loses this direct alarm.; does not take the size back from a viewer that claimed it mid-repaint — A viewer claiming geometry mid-repaint preventing old-size restoration loses this direct alarm.; leaves a swapped-out PTY alone when its nudge is still pending — Swapped-out PTY avoiding a pending repaint nudge loses this direct alarm.; puts the row back when the pane unmounts mid-repaint — Unmount during repaint restoring the nudged row loses this direct alarm.; recovers $name live output when the deadline interrupts an answered snapshot — Answered-snapshot deadline interruption under overflow/small/partial/split-escape/styled/styled-gap/unmapped/unhide-gap/fresh-gap live output loses nine direct recovery examples.; [invariant] reconciles the retained bytes through the deferred post-flood repaint — Queue-overflow quiet abandonment later reconciling retained bytes or disclosing loss loses this direct invariant alarm.; [invariant] keeps recovery armed while the user reads scrollback — Recovery remaining armed during scrollback reading/background stint then following output loses this direct invariant alarm.; [invariant] reconciles the retained bytes after the iteration backstop fires — Iteration-cap quiet abandonment owing later reconciliation/disclosure loses this direct invariant alarm.; does not leave a parked repaint after a repeated episode is repaired — Repeated repaired episode not leaving a parked repaint loses this direct alarm.; keeps the deferred repaint when pending live bytes overflow before the snapshot drains — Pending-live overflow before snapshot drain preserving deferred repaint loses this direct alarm.; keeps the existing repaint behavior for a pending-cap marker — Pending-cap marker preserving deferred repaint behavior loses this direct alarm.; fetches a fresh snapshot when hidden bytes arrived during the first fetch — Bytes arriving hidden during fetch forcing a fresh snapshot loses this direct alarm.; keeps recovery pending after the first snapshot is %s — Rejected/unavailable first capture preserving pending recovery until retry and acknowledgement loses two direct examples.; [modern] repaints a recovered visible pane from the retained host buffer — Visible modern recovery repaint from the retained host snapshot loses this direct example.; [modern] accepts an empty snapshot as successful recovery without a loss banner — Empty modern snapshots counting as successful recovery without loss disclosure loses this direct example.; [modern] waits for a reported outcome instead of applying the old elapsed-time deadline — Modern pending recovery respecting reported outcomes beyond the old elapsed deadline loses this direct example.; [modern] banners on the seventh retry-worthy host answer and never sends an eighth request — Seventh retry-worthy answer causing disclosure and suppression of an eighth request loses this direct example.; [modern] does not spend the host answer budget on locally-gated retries — Locally-gated answers leaving the host-answer budget available loses this direct example.; [modern] still bounds locally-gated retries at their own cap — Repeated local gating eventually ending recovery and disclosing loss loses this direct example.; [modern] banners immediately on permanent unavailability without retrying — Permanent host unavailability immediately disclosing loss without retry loses this direct example.; [modern] cancels a live flood repaint when it declares the output unrecoverable — Unrecoverable declaration cancelling a later flood repaint loses this direct example.; [legacy] switches an explicit unknown-host answer to the existing four-request heuristic — Explicit unknown-host result switching to legacy recovery heuristic loses this direct example.; [modern] parks retry repaint while scrolled back and resumes when following output — Scrolled-back recovery parking until follow-output resumes loses this direct example.; clears the captured pen for a normal-buffer fallback reattach — Fallback normal-buffer reattach clearing captured pen and dirty background loses this direct example.; waits for a recovered destination fit before forwarding its grid or live output — Recovered destination fitting before forwarding grid or live output loses this direct example.; suppresses the deferred reattach grid push when mobile claims the PTY while hidden — Mobile takeover while hidden suppressing deferred reattach grid forwarding loses this direct example.; drops stale callbacks but delivers fresh replacement output after an old replay clear — Fresh replacement output winning over stale callbacks after old replay clear loses this direct example.; clears the mobile-fit pane binding when the pane connection is disposed — Pane dispose clearing the mobile-fit binding and PTY dataset loses this direct example.; continues post-spawn size reconcile after a transient mobile presence lock — Size reconciliation continuing after a transient phone-presence lock loses this direct example.; spawns the delayed primary pane of an issue-command split when its sibling owns the tab PTY fallback — Delayed primary split spawning independently after a sibling acquires tab fallback loses this direct example.; does not reuse a sibling split pane pending spawn after remount — Remounted primary adopting its own pending PTY rather than the sibling spawn loses this direct example.; replays a stable-pane adoption without submitting the resume command — Stable-pane adoption replay preserving replay-before-live ordering and suppressing resume command loses this direct example.; forwards focus and hover reports without claiming a parked mirror (#26469) — Passive focus/hover forwarding without stealing mirror ownership, then intended Ctrl+C/click claiming, loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport\",\n        \"pnpm test src/shared/terminal/protocol/escape/terminal-synchronized-output-socket-splits.test.ts\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"startup output covered by the snapshot is painted once\",\n            \"new output remains visible\",\n            \"legacy unsequenced and blank snapshots retain bytes\"\n          ]\n        }\n      ]",
        "Audit3077 retires the IPC zero/nonzero snapshot-sequence and zero-keyboard-proof examples and their direct selectors. The retained join projects only sequence 7 and flags 3. No equivalent replacement or fresh gate execution is claimed.",
        "Audit3069 retires nominal spawn/resume/banner wiring, first-fit and lookup-budget variants, private pending-map checks, the split-CWD disposal suite and startup command/draft baseline variants. Distinct regression alarms are intentionally lost without equivalent replacement; retained ownership, cancellation and recovery cases remain. Existing selectors and dated evidence retain their original scope.",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope.",
        "Audit3053 reduces hidden-replay coverage by retiring nominal overlap, resize, cursor metadata and standalone stalled-restore variants. Timeout, overflow, identity/generation fences and retained live-output coordination remain; the removed alarms are intentionally lost without equivalent replacement. Existing commands, assertion references and dated evidence retain their original scope.",
        "Audit2694 intentional coverage losses (source-only, no replacement): src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-command-finished-interrupt-arbitration.spec.ts: 'drops the command-finished status when pending interrupt inference is rejected': Loses the standalone rejected-inference-to-drop alarm; the delayed-write rows remain but are not equivalent to this immediate rejection example. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'forwards raw onData after a bell as a query reply': Loses raw onData forwarding after the manually raised bell, including its hibernation-counter expectations. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'blocks onData on a stale codex pane': The real isCodexPaneStale guard executes, and removing it would allow the typed a to reach transport. Intentionally loses this genuine stale-account typing refusal alarm. No retained query-reply test is claimed equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'omits byte-parser callbacks from the local transport options': Loses local main-authority callback omission and lifecycle callback presence checks. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'keeps byte-parser callbacks on remote-runtime transports': Loses remote-runtime parser callback preservation and factory-argument alarm, including this compatibility boundary; no mixed-version execution is covered. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'consumes pty:sideEffect facts with the live-path policy after spawn': Loses title/bell fact routing and exact 250ms delayed fake notification example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'schedules the completion notification for genuine working→idle facts': Loses positive main-fact working-to-idle scheduling alarm. Retained stale/race cases do not replace this positive example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'drops the agent status from a command-finished fact like the byte path did': Loses command-finished fact-to-drop routing and removeAgentStatus noncall alarm. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'routes pr-link facts to the worktree PR observer': Loses PR-link fact forwarding, worktree/tab/PTY arguments alarm; retained raw-byte nonconsumption is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'seeds and settles Command Code status from command-code facts': Real Command Code seed/settle policy runs. Loses positive seed, prompt payload, and 1499+1ms completion boundary alarm; retained newer-working cancellation is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'does not byte-scan Command Code output — facts are the only consumer': Loses Command Code-specific no-byte-parser alarm. Retained PR/OSC raw-byte exclusion does not cover this parser. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-notification-settings-gating.spec.ts: 'shares one raw store subscriber for agent-complete notification settings across panes': Actual shared subscribe/unsubscribe runs. Loses shared single-subscription and final-pane unsubscribe lifetime alarm, with no replacement claimed. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'dispatches agent-task-complete for generic Codex spinner titles after process identity is confirmed': Real coordinator evidence path runs over fake process answers. Loses positive generic-title/confirmed-Codex completion and inspectProcess-argument alarm. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'normalizes Pi-compatible remote titles to authoritative OMP launch identity': Real owner-compatible normalization runs. Loses Pi-to-OMP title/status normalization, active tab label, OSC observation, and retained launch-identity example; no real remote transport or equivalent replacement. Wrapper cleanup removes only the deleted bell factory import and its registration-only describe block; no additional authored removal credit. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The retained directory-level discovery command continues to discover the reduced family; historical wrapper mentions are not fresh import-closure or execution evidence.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-coalesce.test.ts: surfaces working frames when many spinner frames arrive in one chunk. src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-pi-spinner.test.ts: surfaces normalized working and idle labels across a spinner cycle; surfaces working even when a single chunk contains multiple spinner frames. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Composer draft creation and cancellation are not implemented by this gate.",
        "No new live SSH, Windows or WSL UI run; remote evidence is focused contract tests.",
        "Mixed-version snapshots without sequence proof intentionally retain legacy behavior.",
        "Retired during audit1319 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-09-04\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport\",\"result\":\"passed\",\"durationSeconds\":5.67,\"summary\":\"Broader connection/transport gate: 77 files and 813 tests passed, including neighboring restore, reconnect, input and replay behavior. Log: artifacts/worktree-create/orca-draft-replay-broader-gate.log.\"}",
        "Audit1342: src/renderer/src/components/terminal-pane/pty-connection-unanswered-command-finish.spec.ts removed. Unanswered SSH shell finish keeps/drops mocked agent row matrix disappears. src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts reduced. Happy inherited-cwd wait and transport-option forwarding sample loses its individual alarm. src/renderer/src/components/terminal-pane/pty-connection-command-input-agent-identity.spec.ts removed. Typed Droid versus process/launch identity and SSH/runtime process-evidence matrices disappear. src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts removed. Success/no-ID/expired/superseded attach-settlement bag alarms disappear. src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts reduced. Every-write kind forwarding and synchronous driving-attempt observer/rejection/ACK call counts disappear. src/renderer/src/components/terminal-pane/pty-connection-codex-restart-input-lookup.spec.ts removed. No global tab enumeration on ordinary/stale input and known restart notice input-block mock-call alarms. src/renderer/src/components/terminal-pane/pty-connection-layout-owner-wake.test.ts removed. Hidden-to-visible single-pane start request, attach-only argument and negative local wake-record alarms are intentionally dropped; no real server wake/ack occurs. src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\",\"windows\"],\"coveredProviders\":[\"local\",\"daemon\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1361: src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts reduced. Internal searched-character budget and ordinary/malformed no-op controls. No equivalent replacement coverage is claimed.",
        "Audit1361 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"daemon\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1369: src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts removed. Rootless/removed/moved tabs, missing leaves, queued deletion and host-qualified/legacy deletion eligibility fixtures. No equivalent replacement coverage is claimed.",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed.",
        "Audit1391 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-04\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm test src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.34,\n          \"summary\": \"5 suites / 48 tests pass. Focused 2-suite runs independently pass 27 tests on Linux, Windows and WSL.\",\n          \"currentCommand\": \"pnpm test src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\"\n        }",
        "Audit1391 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/renderer/src/components/terminal-pane/pty-connection/terminal-input-echo-delay.test.ts reduced. Removes two fabricated-binding pipeline registrations; retains timestamp-policy outcomes without wall-clock speed assertions. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. src/renderer/src/components/terminal-pane/pty-connection/main-pane-resume-banner.test.ts reduced. Loses subscription-budget and attach-start generation predicate alarms; actual restored-banner renderer is not exercised. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/pty-connection/main-pane-start-wait.test.ts: Loses joined waiter invocation/failure notification and raw terminal error/paired-host readable sentence alarms; survivors preserve hold detection and card clearing. deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts: Loses typed-input forced synchronized-frame presentation alarm; setup implements the parser behavior it claims to exercise. deletes src/renderer/src/components/terminal-pane/pty-connection-unserved-ssh-pane.test.ts: Loses automatic SSH dial deduplication, passphrase gating, stale pane exclusion, and disposal cancellation alarms. deletes src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts: Loses source grid before frame and destination grid restoration ordering alarm. deletes src/renderer/src/components/terminal-pane/pty-connection-restart-replacement.spec.ts: Loses wrapper-level hidden/visible restart resume, dispose/rebind suppression and finished-turn replay alarms; manual pipeline and mock-implemented binding invalidate the whole callbacks. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1939 (sources1934/1935): The existing directory-level pnpm test selector includes eleven changed source files and automatically omits the three whole deletions. Keep this nonempty discovery command unchanged; no dated receipt uses this broad path. Removed agent admission fields, mock transport routing and terminal-id projection alarms are lost. Retained foreground state, actual headless xterm, redraw, abort/rebind reader and bridge claim progression remain scoped to their unchanged callbacks. No current-source execution, independent replacement, native transport or physical provider result is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'bounds a startup title storm to one extra read ladder and never adopts the title as identity'; 'leaves untrackable providers free of client process scans'; 'keeps a legacy remote process hint unverifiable after a startup title'; 'releases a retained capability when disposed mid-read'; 'releases a retained capability when an exit schedules no successor read'; 'releases a retained capability when an untrackable $exit ends the read'; 'does not release when the cancelled read has a successor'; 'settles the visible confirmation when the pty id is gone before the read runs'; 'reports a read in flight when a command-finished read owns the pane'; 'reads the foreground once after a command starts and publishes the recognized agent'; 'does not replace known foreground identity with typed command inference'; 'revokes stale routing immediately while a known pane confirms a new command'; 'reads the foreground for a visible PTY so restored running Codex panes regain identity'; 'does not retry or publish visible PTY reads for an idle shell foreground'; 'retries visible PTY reads only while a foreground wrapper may resolve to an agent'; 'stops after the ladder and publishes no identity for a persistent unknown process'; 'does not treat a nested shell seen mid-command as prompt proof'; 'recognizes an agent started from a nested shell on a ladder re-read'; 'marks shell foreground on command finished without any foreground read'; 'trusts a rapid ordinary command finish without forcing a fresh scan'; 'still marks shell without a read for a duplicate D pair on an idle pane'; 'marks shell on a rapid command start->finish when the foreground is a shell'; 'marks shell foreground when the confirming read shows the agent is gone'; 'confirms a command finished for a launch-known agent pane before any read'; 'accepts a fresh shell result for a launch-known Droid pane'; 'marks a confirmed shell without repeating a post-boundary scan'; 'never reads or publishes for remote or ssh panes'; 'does not let forged OSC 133/777 output assert remote identity'; 'keeps command-only pane inference bounded for large pasted scripts'; 'skips jcode colors for command-only startup %s'; 'keeps explicit pane ownership ahead of a delayed command hint'; 'does not infer a TUI from %s'; 'survives a launch config registered before its identity lands'; 'prefers the tab launch agent over every later signal'; 'falls back through startup, then initial status, then the registered config'; 'ignores a registered agent name that is not a known TUI agent'; 'skips the OSC color answer for jcode and no one else'; 'drops a Done that landed before the command-finished fact'; 'keeps a program Done reported before the command-finished fact'; 'dismisses the kept result when the next command starts'; 'keeps a facet-less OSC Done from a non-agent program'; 'still drops a real agent Done'; 'still drops an interrupted program Done'; 'retires a hook-identified row the foreground tracker never read'; 'leaves a pane with an armed command-finished drop to its own confirming read'; 'leaves a remote pane to its execution host'; 'keeps the row when the host can verify the owner process itself'; 'keeps a row that belongs to a different agent'; 'does not watch the store for an owner it can never name'; 'control: a fresh host image repaints the pane without resizing the program'; 'asks the program to repaint when the image is %s'; 'asks the program to repaint when the host never answers the snapshot request'; 'repaints a full-screen TUI on the alternate screen the same way'; 'leaves the size alone while a phone or another desktop holds it'; 'grows a pane at the host minimum height instead of asking for the same clamped size'; 'does not nudge while the stream is still reconnecting'; 'mounts and remounts the tab owner while an unrelated workspace is active (%s)'; 'continues a recorded live folder owner despite ambiguous inventory (%s)'; 'resolves an encoded split surface using its parent tab and active leaf'; 'does not capture a remote revision for a local terminal'; 'omits incarnation and length for older runtime responses'; 'refuses %s owner before RPC'; 'refuses a resolved terminal belonging to another native PTY'; 'refuses a foreign remote terminal handle despite a matching native PTY ID'; 'refuses a remote handle owned by another environment'; 'refuses a remote terminal with no live native PTY'; 'does not fall back locally when remote lacks RPC'; 'rejects malformed or oversized encoded response %#'; 'maps a unified terminal tab id to its legacy owner id'; 'keeps non-terminal and unknown ids unchanged'; 'keeps an exact terminal owner ahead of a stale unified alias'; 'stays inert on a host that was not kept for the bridge'; 'stays inert for a pane main does not list, so it still dials the host'.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-spawn-intent.test.ts: declares the intent only when the spawn resumes an agent; reports a deferral to the pane instead of an error toast. src/renderer/src/components/terminal-pane/pty-connection/startup/in-place-resume-hold.test.ts: owns the record while the start runs, through a nested start, and releases on settle; holds nothing for a start not resuming a record, or once the pane is disposed. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-agent-trust-hold.test.ts: spawns only after the answer, carrying \"let agents ask\" to main for this launch; reattaches a section terminal without asking or changing trust; spawns with today's default when the prompt is released without an answer. src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-ssh-hook-status-authority.spec.ts: leaves SSH IPC OSC 9999 status ownership in the main runtime. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionSshHookStatusAuthorityTests } from '../host-ownership/pty-connection-ssh-hook-status-authority.spec'; registerPtyConnectionSshHookStatusAuthorityTests(). Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit3086: the transport filename selector loses IPC suspension/input/reattach cases and the entire spawn-errors suite. Unique classification, ownership, fallback retirement, reply-limit, write-failure and teardown-branch alarms are intentionally retired without replacement. Remaining registrations are unchanged; no fresh execution or real provider result is claimed.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport\",\n        \"pnpm test src/shared/terminal/protocol/escape/terminal-synchronized-output-socket-splits.test.ts\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"startup output covered by the snapshot is painted once\",\n            \"new output remains visible\",\n            \"legacy unsequenced and blank snapshots retain bytes\"\n          ]\n        }\n      ]",
        "Audit3392 validation correction: no remaining directly selected suite protects prestarted snapshot adoption; protection is none. Remaining broad scan commands do not establish this invariant. Retired gate status, covered scope, commands and complete dated receipt follow as historical raw values:\nprotection: \"partial\"\ncommands: [\n        \"pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport\",\n        \"pnpm test src/shared/terminal/protocol/escape/terminal-synchronized-output-socket-splits.test.ts\"\n      ]\ncoveredPlatforms: [\"linux\"]\ncoveredProviders: []\nevidenceRuns: [\n        {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.31,\n          \"summary\": \"Test Files  1 passed (1); Tests  3 passed (3). Source head 8880357cb420c45f1b808ae545a5bc609324624d. Focused retained foreground-output scan only, not all directory-selected gate cases or live provider behavior. Node24.22.0 with ORCA_BACKGROUND_LAUNCH=1 and an isolated Xvfb display.\",\n          \"currentCommand\": \"pnpm test src/shared/terminal/protocol/escape/terminal-synchronized-output-socket-splits.test.ts\"\n        }\n      ]"
      ],
      "demotionRule": "Keep experimental or demote if adoption duplicates covered output, drops newer or unproven output, changes terminal ownership, or flakes without explanation."
    },
    {
      "id": "terminal-session.io-failure-cleanup",
      "title": "Native PTY I/O failures preserve termination ownership",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "provider-contract",
      "surfaces": ["daemon PTY teardown"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "ssh-daemon", "paired-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local-daemon"],
      "coverageNotes": "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real TerminalHost, Session, and subprocess wrapper with injected native I/O failures and mocked OS signals. Local non-daemon and SSH-relay implementations are unaffected; daemon consumers on SSH, WSL, paired runtimes, and mobile retain host-owned semantics. Live Linux/Windows/WSL and remote runs remain gaps. No git or folder-workspace assumptions. The fault-injection suite also runs with simulated darwin/linux/win32 platform branches; these do not constitute native OS coverage. Native macOS coverage now proves shell exit and PTY master-fd closure, input/output round trips, and teardown of a paused producer for both graceful and immediate cleanup. Windows single-close/job escalation and pre-listener output/status are fault-injected contracts. Audit1302: src/main/daemon/terminal-host-teardown-recreate.test.ts: Fake subprocess handles synthesize exits via real40ms/30s timers or manual exit callback, with descendant retirement mocked away; assertions inspect isNew/refusal/spawn counts. No real subprocess/PTY teardown/recreation or owned-tree retention boundary. Lose artificial teardown/attach/shutdown/cancellation scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
      "motivatingLinks": ["docs/terminal-daemon-session-leak-investigation.md"],
      "invariant": "I/O errors must not establish physical exit or disable termination of an owned PTY. Session and native handle disposal require the exit event.",
      "oracle": "Inject write and resize failures, require graceful and forced signals to reach the native owner, keep producer resume available, suppress repeated failed I/O, deliver output and exit, and suppress signals after exit. Across 32 create/close cycles per failure, retain each session before exit and release its native handle and emulator exactly once afterwards. Mark physical exit before notifying listeners; reentrant kill/forceKill/signal from those listeners must never signal the retired PID. A native POSIX test performs input/output and resize, pauses the producer, injects each I/O failure, then gracefully or immediately closes 16 real shells; require ESRCH for each child PID and EBADF for each PTY master fd.",
      "commands": [
        "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts",
        "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts src/main/daemon/sessions/testing/session.test.ts",
        "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
      ],
      "testFiles": [
        "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts",
        "src/main/daemon/pty-subprocess/testing/pty-subprocess-handle-lifecycle.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-session-teardown.test.ts",
        "src/main/daemon/sessions/testing/session.test.ts",
        "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts",
          "assertions": [
            "keeps graceful and forced termination available until physical exit",
            "reaps every session and native handle across 32 failed-I/O create/close cycles",
            "suppresses repeated native I/O failures while still delivering output and exit",
            "blocks reentrant termination from an exit listener after I/O failure"
          ]
        },
        {
          "file": "src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts",
          "assertions": ["reaps real shells and master fds after %s failure (immediate=%s)"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-07",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm test src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts",
          "result": "passed",
          "durationSeconds": 3.71,
          "summary": "32 tests passed with 4 Windows-only cases skipped; simulated macOS/Linux/Windows branches include 192 failed-I/O create/close cycles and exit-listener reentrancy.",
          "currentCommand": "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-cleanup.test.ts"
        },
        {
          "date": "2026-09-07",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm test src/main/daemon/pty-subprocess-io-failure-native.test.ts",
          "result": "passed",
          "durationSeconds": 2.52,
          "summary": "Four native cases pass across 16 real shells, including input/output, pause before teardown, confirmed PID absence, and closed PTY master fds.",
          "currentCommand": "pnpm test src/main/daemon/pty-subprocess/testing/pty-subprocess-io-failure-native.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "focused daemon teardown contract tests"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Initial deterministic local run; no soak history."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "All four original regression cases failed before the fix because native kill was never called; the unchanged cases passed after separating I/O failure from exit. Two additional output/flow-control cases also pass. Review added two failing exit-listener reentrancy cases; publishing physical exit before callbacks made them pass."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "One boolean per PTY; no new timers, scans, retries, or subprocesses. Existing failed-I/O suppression remains. 192 closures under three simulated platform branches return session inventory to zero and dispose each emulator/native handle once."
      },
      "promotionCriteria": [
        "Collect remaining native cross-platform evidence plus the standard soak history."
      ],
      "knownGaps": [
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Fault injection proves a leak mechanism, not causality for the historical 427-session incident.",
        "Real Linux/Windows/WSL, remote, startup-close, login-wrapper descendants, and multi-day load evidence remain outstanding. Native tests inject synchronous I/O errors; they do not model every asynchronous node-pty pipe failure.",
        "No output throughput change or interactive latency benchmark is included.",
        "Audit1302: src/main/daemon/terminal-host-teardown-recreate.test.ts: Fake subprocess handles synthesize exits via real40ms/30s timers or manual exit callback, with descendant retirement mocked away; assertions inspect isNew/refusal/spawn counts. No real subprocess/PTY teardown/recreation or owned-tree retention boundary. Lose artificial teardown/attach/shutdown/cancellation scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm test src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts src/main/daemon/pty-subprocess-handle-lifecycle.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/daemon/terminal-host-teardown-recreate.test.ts src/main/daemon/terminal-session-teardown.test.ts src/main/daemon/session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.617,\n          \"summary\": \"136 tests passed across six files; failed-I/O cycle tests cover 64 closures.\"\n        }"
      ],
      "demotionRule": "Keep experimental; investigate any lost cleanup signal, premature exit, or unexplained flake."
    },
    {
      "id": "cmd-j-tabs.host-qualified-candidate-ownership",
      "title": "Cmd-J tab candidates retain execution-host ownership",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "renderer-workspace-tabs",
      "layer": "renderer-state-and-navigation",
      "surfaces": [
        "Cmd-J browser tabs",
        "Cmd-J simulator tabs",
        "Cmd-J workspace tabs",
        "paired-runtime tab mirror"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2729 reduces browser-page-palette-activation.test.ts: separate SSH/paired-runtime alias forwarding, distinct multigroup views accepted, and remote-folder activation forwarding alarms are removed. Collision refusal, preactivation address-bar focus capture, owning-group activation state and missing-tab refusal remain byte-identical. No equivalent replacement, fresh gate execution or actual host/browser delivery evidence is claimed. Prior coverage account: Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 reduces cmd-j-host-qualified-candidate-ownership.test.ts to the scoped open-tab hidden same-ID legacy ambiguity refusal. Separate browser/simulator paired-runtime alias and current-row projections, generic workspace host projection and hostless explicit-owner refusal examples are removed without equivalent replacement. No fresh gate execution, browser activation, physical host, simulator or remote delivery evidence is claimed. Historical dated receipts and budgets remain raw-byte exact. Prior coverage account: Audit1899 replays sealed Audit1895: workspace-session-schema.test.ts keeps only cross-workspace truncated-tab salvage and legacy browser-history cap normalization. Four current commands and testFiles retain that reduced source; no current assertionRef or active receipt selects it. SSH file-owner, isolated browser partition, launch/title/quick-command fields, recency, structured-chat/view-mode and remote browser identity hydration alarms are intentionally lost. Existing retired receipt strings and unrelated active receipts remain verbatim. No equivalent replacement, new Cmd-J gate execution, native simulator or remote/browser restore proof is claimed. Historical coverage account before Audit1899: Audit1494 removes use-open-tab-search.test.ts. Supplied host/worktree/title/ranking projections, simple subscription updates and result-array identity alarms are retired. No actual activation or navigation occurred in that suite. No equivalent replacement coverage or fresh Cmd-J gate validation is claimed. Historical receipts remain scoped to their original selectors. Audit1433 narrows worktree-checks-review-index.test.ts to same-ID local/SSH object-key review isolation. Local provider/cache lookup, GitLab preference, suppression/legacy fallback, explicit-PR authority, physical-versus-runtime review isolation, and branchless-workspace alarms are intentionally removed. No equivalent replacement coverage is claimed. Historical receipts and commands remain unchanged and do not certify the reduced source. Historical coverage account: Audit1396 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic candidate-builder contracts inject local and paired-runtime worktrees with the same bare id into the real aggregated tab buckets, including folder workspaces and a paired runtime transporting an SSH-owned worktree. A mirror contract preserves distinct same-id runtime tabs. A paired Electron journey verifies both visible browser rows and both visible simulator rows, then requires each selection to render its owning active tab and update backing host-qualified state. The test-value audit narrowed simulator-palette-search.test.ts to the recency tie, same-id host isolation, ambiguous legacy host rejection and oversized-input getter tripwire. Supplied timestamp, empty-query context ordering, host projection, alias/range, metadata matching, active-tab score, over-token/whitespace and malformed display-name fallback examples were removed. Their separate alarms are lost; retained candidate and activation contracts do not establish equivalent coverage. Historical run commands and results remain historical. The audit also removed the standalone workspace-tab-palette-search suite: supplied row, title, metadata, alias, range, ranking and ownership examples no longer provide their separate alarms. Other retained contracts are not replacement coverage. The mirror-identity fixture now retains same-id sibling-runtime isolation and the repeated-frame subscriber tripwire only. Supplied field, owner, alias and mapping examples are removed; their separate alarms are lost. The retained sibling-runtime case is not equivalent coverage for them. The test-value audit removed tabs-open-close-lifecycle host-stamping examples and ordinary tab/group operations from tabs-pane-layout-operations. Local-null, explicit-runtime and SSH-without-active-host stamp assertions are lost; retained mobile/MRU and subscriber/atomic split cases do not replace them. Candidate and live Cmd-J evidence retains its own scope. Historical commands, outcomes and narratives remain historical. Audit1308: src/renderer/src/lib/browser-palette-search.test.ts removed. Browser-palette token and pasted-query size-guard work alarms disappear. No equivalent replacement coverage is claimed. Audit1386: src/renderer/src/lib/open-mobile-emulator-tab.test.ts reduced. Duplicate attach count and null-tab creation retry/guard reset standalone alarms removed; no simulator device used. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/lib/simulator-palette-search.test.ts reduced. Lose simulator-specific lastFocusedAt tie-order alarm; identity/routing and pre-scan size fence remain. No native simulator or real remote launch claim. No equivalent replacement coverage is claimed. Audit1402: src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts reduced. Loses repeated no-op frame store-notification budget; independent cross-runtime resource preservation remains. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4965",
        "https://github.com/stablyai/orca/pull/15371"
      ],
      "invariant": "Candidate identity is the tuple of execution-host identity and worktree identity: same-id sibling hosts retain separate correct browser, simulator, and workspace tabs, each tab appears exactly once, and selection activates its owning host.",
      "oracle": "Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed. Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added. Prior coverage account (preserved verbatim): Audit2266 current retained source checks only that scoped open-tab search rejects hostless legacy browser, simulator and workspace tabs when a hidden same-ID sibling host remains in the ownership catalog. Reduced selectors require fresh validation; existing historical receipts do not validate the changed source. Prior oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Aggregate two hosts' tabs under one intentionally colliding worktree id, stamp each unified tab with its execution host, and require exactly one candidate per owner. Repeat with an SSH physical owner transported by a paired-runtime alias. Independently require each browser and simulator Cmd-J selection to update activeWorkspaceExecutionHostId plus its owning workspace/group and render the selected tab active. Ambiguous legacy tabs without ownership fail closed.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/shared/workspace-session/workspace-session-schema.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/lib/simulator/launch/open-mobile-emulator-tab.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts",
        "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
        "src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx",
        "src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts",
        "src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts",
        "src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts",
        "src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts",
        "src/renderer/src/lib/simulator/launch/open-mobile-emulator-tab.test.ts",
        "src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts",
        "tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts",
        "src/shared/workspace-session/workspace-session-schema.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
          "assertions": ["same-id local and SSH worktrees keep separate review-index results"]
        },
        {
          "file": "src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts",
          "assertions": [
            "same-id local and remote browser tabs appear once under their owning hosts"
          ]
        },
        {
          "file": "tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts",
          "assertions": [
            "both browser selections activate and render their owning host and workspace",
            "both simulator selections activate and render their owning host and group"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-20",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 12.7,
          "summary": "The paired Electron journey passed real host browser publication, same-id collision injection, separate browser/simulator Cmd-J rows, and selected-host backing-state assertions.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-20",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 24.1,
          "summary": "A fresh electron-vite --mode e2e build passed the paired journey: the visible Cmd-J list retained one owning browser/simulator row and each selection changed the execution host plus its owning workspace or group.",
          "currentCommand": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-20",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
          "result": "failed",
          "durationSeconds": 0.2,
          "summary": "The final review-cache oracle failed 1/6: a runtime-owned SSH worktree exposed the physical host's cached pull request.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts"
        },
        {
          "date": "2026-08-20",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
          "result": "failed",
          "durationSeconds": 0.4,
          "summary": "The exact-head clean-round oracle failed 1/6: after the host-qualified index rejected a physical SSH review, the palette document still surfaced its unqualified legacy cache entry for the runtime-owned worktree.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts"
        },
        {
          "date": "2026-08-20",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 36.7,
          "summary": "A fresh e2e-mode Electron build passed the paired journey: each remote/local browser and simulator candidate appeared exactly once, selected the owning host plus workspace or group tab, and rendered that tab active. The group active-tab oracle remains stable while asynchronous paired session mirroring updates the legacy bare-worktree activeTabType field.",
          "currentCommand": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-21",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 20.6,
          "summary": "After a fresh build exposed an unrelated mirrored terminal entering the broad backing-state diagnostic, the exact built candidate passed with that oracle scoped to the four seeded browser/simulator tabs; rendered active-tab and backing execution-host assertions remained green.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Changed selectors have no new soak result after Audit1396; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1308; any retained unchanged-source receipts apply only to their own commands. Historical account: The candidate contract has no timers. Initial Electron attempts exposed seeded-worktree discovery and programmatic keyboard-selection harness races before the ownership assertions; soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1396 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1308 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Byte-identical browser and simulator candidate tests failed 4/28 on affected baseline 012e9f410c, passed 28/28 on candidate fe45b73c20, failed the same 4/28 when only the two candidate filters were disabled, and returned to 28/28 after restoration. Review-round topology contracts failed 4/40 before the alias/generic/local-stamping follow-up; final-review contracts then failed 4/16 before folder/background/worktree-metadata hardening, 1/6 before paired repository-metadata hardening, 1/7 before unavailable-runtime fail-closed hardening, 1/12 with the component's physical-host bypass restored, 1/6 before review-cache ownership used the same resolver, 1/6 before the downstream document rejected a remote owner's unqualified legacy cache entry, and 1/6 when a host filter or scoped open-tab search hid the same-id sibling from legacy ambiguity detection. Manual local-provider ownership failed 1/12 before explicit host routing, and pre-hydration dedupe failed 1/13 before exact stamped-owner reuse; the combined contracts then passed 25/25 and the six-file review suite passed 73/73. The prior completed focused suite passed 225/225. Historical results include examples subsequently removed in the test-value audit; they do not establish current coverage for those removed assertions."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Candidate construction adds bounded in-memory ownership filtering over the already-read worktree tab bucket and introduces no polling or network work."
      },
      "promotionCriteria": [
        "Collect paired Electron CI soak history without unexplained flakes.",
        "Add a live paired-runtime-over-SSH journey when the E2E harness can provision that combined topology."
      ],
      "knownGaps": [
        "Audit2729 retires browser palette standalone paired-runtime SSH alias forwarding, multigroup-view acceptance and remote-folder forwarding alarms without equivalent replacement. The retained partial suite has no fresh execution result; existing exact receipts and budgets stay scoped to their unchanged selectors.",
        "Audit2697/2702 intentional palette coverage losses: 'omits a browser row whose backing tab id is duplicated': Remove malformed duplicate unified-tab-ID fixture and its empty result. Real duplicate-ID suppression alarm is lost; this narrow private inventory has no palette selection or activation flow. 'omits a workspace claimed by more than one unified browser tab': Remove two unified browser claims of one workspace. Real first-indexed-foreign-versus-later-owned collision rejection alarm is lost; same-host and ambiguous legacy cases do not replace it. 'omits a workspace whose single unified browser tab is not owned by this worktree': Remove one unique workspace backed by foreign-worktree unified tab fixture. Real foreign-tab/worktree rejection alarm is lost; stamped host tests are not equivalent to foreign worktree mismatch. 'indexes workspace tabs when building a large browser palette': Remove internal getter read budget over1000workspaces: current main policy explicitly rejects getter/Proxy/read counts and says performance changes get correctness tests only. Loses direct quadratic-indexing cost alarm and positive1000workspace output check; no equivalent replacement claimed. The same source review also deletes browser-link-profile-isolation.test.ts (two authored/five expanded) and removes two HTTP-routing declarations (three expanded). Exact tracked-tree filename/case search finds no active gate selector/assertionRef for those navigation sources; their local profile isolation/reuse, deferred minted-profile privacy/lifetime, foreground view/group projection and contextless must-create-page alarms still disappear without replacement. This palette gate is not credited with coverage of those unrelated navigation cases. Historical shard timings are retained unchanged. Audit2697 browser source review (metadata followup2702): Reduce src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts by four authored/expanded cases without replacement. The remaining three cases preserve only their existing same-ID execution-host separation, absent stamped-owner refusal and ambiguous legacy-bucket refusal scope. Intentionally lose duplicate backing-tab-ID suppression, multiple unified-browser claims of one workspace, foreign-worktree unified-tab rejection, and the 1000-workspace output/internal getter-read budget alarm. These are real removed alarms; the retained host cases are not equivalent replacements. Current test-value policy rejects internal getter/read budgets; no replacement performance or measured-cost claim is made. Keep existing nonempty selectors and the retained same-ID browser assertionRef. No fresh gate execution or reduced-source validation is supplied; dated receipts, results, commands and historical coverage accounts remain within their original source scope. No live browser activation, physical provider, mixed-version execution, mobile, native UI, platform hardware, soak or timing result is added.",
        "Live Linux, Windows, and paired-runtime-over-SSH journeys are not collected; the SSH/runtime dual-owner topology is deterministic renderer coverage.",
        "The paired Electron simulator path seeds renderer state because remote web clients cannot launch a native emulator.",
        "The paired Electron journey proves a real host mirror stamp before injecting the same-id sibling state; it does not create the collision through the wire.",
        "Mixed-version behavior is covered by optional-field parsing and fail-closed legacy ambiguity, not a live old-client/new-host matrix.",
        "The test-value audit removed the palette repository resolver examples and manual emulator local-provider routing assertion. Their historical alarms are no longer provided by these suites; the retained emulator cases cover narrower coordination boundaries. No equivalent coverage is claimed.",
        "The test-value audit narrowed simulator-palette-search.test.ts to the recency tie, same-id host isolation, ambiguous legacy host rejection and oversized-input getter tripwire. Supplied timestamp, empty-query context ordering, host projection, alias/range, metadata matching, active-tab score, over-token/whitespace and malformed display-name fallback examples were removed. Their separate alarms are lost; retained candidate and activation contracts do not establish equivalent coverage. Historical run commands and results remain historical.",
        "The mirror-identity fixture now retains same-id sibling-runtime isolation and the repeated-frame subscriber tripwire only. Supplied field, owner, alias and mapping examples are removed; their separate alarms are lost. The retained sibling-runtime case is not equivalent coverage for them.",
        "The test-value audit removed tabs-open-close-lifecycle host-stamping examples and ordinary tab/group operations from tabs-pane-layout-operations. Local-null, explicit-runtime and SSH-without-active-host stamp assertions are lost; retained mobile/MRU and subscriber/atomic split cases do not replace them. Candidate and live Cmd-J evidence retains its own scope. Historical commands, outcomes and narratives remain historical.",
        "Audit1308: src/renderer/src/lib/browser-palette-search.test.ts removed. Browser-palette token and pasted-query size-guard work alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1308 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 10.5,\n          \"summary\": \"The review-hardened candidate passed 189/189 focused contracts, including direct browser-result host fallback, SSH plus paired-runtime current-row aliases, explicit-owner fail-closed behavior, generic workspace rows, simulator reuse, local creation stamping, activation, and same-id distinct-runtime mirror preservation. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session-schema.test.ts\"\n        }",
        "Audit1308 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-21\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session-schema.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 24.3,\n          \"summary\": \"The OpenCode-review-hardened candidate passed 225/225 focused contracts, including unfiltered ownership ambiguity under host filters and scoped open-tab search, review-cache ownership, rendered palette repo metadata, folder workspaces, inactive local simulator creation, paired SSH/runtime display metadata, and explicit-owner fail-closed resolution. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\"\n        }",
        "Retired during audit1312 current-main refresh; original complete execution receipt (unchanged): {\"date\":\"2026-08-20\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts\",\"result\":\"passed\",\"durationSeconds\":10.5,\"summary\":\"The review-hardened candidate passed 189/189 focused contracts, including direct browser-result host fallback, SSH plus paired-runtime current-row aliases, explicit-owner fail-closed behavior, generic workspace rows, simulator reuse, local creation stamping, activation, and same-id distinct-runtime mirror preservation. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"}",
        "Retired during audit1312 current-main refresh; original complete execution receipt (unchanged): {\"date\":\"2026-08-21\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\",\"result\":\"passed\",\"durationSeconds\":24.3,\"summary\":\"The OpenCode-review-hardened candidate passed 225/225 focused contracts, including unfiltered ownership ambiguity under host filters and scoped open-tab search, review-cache ownership, rendered palette repo metadata, folder workspaces, inactive local simulator creation, paired SSH/runtime display metadata, and explicit-owner fail-closed resolution. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\"}",
        "Audit1386: src/renderer/src/lib/open-mobile-emulator-tab.test.ts reduced. Duplicate attach count and null-tab creation retry/guard reset standalone alarms removed; no simulator device used. No equivalent replacement coverage is claimed.",
        "Audit1396: src/renderer/src/lib/simulator-palette-search.test.ts reduced. Lose simulator-specific lastFocusedAt tie-order alarm; identity/routing and pre-scan size fence remain. No native simulator or real remote launch claim. No equivalent replacement coverage is claimed.",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 0.5,\n          \"summary\": \"The byte-identical oracle on affected baseline 012e9f410c failed 4 tests and passed 24: each same-id browser and simulator tab was routed through both hosts, and ambiguous unstamped rows were duplicated instead of failing closed.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts\"\n        }",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 0.5,\n          \"summary\": \"The same oracle on fe45b73c20 with only browser-palette-page-entries.ts and simulator-palette-search.ts restored from origin/main failed the same 4 tests and passed 24; restored candidate files passed all 28.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts\"\n        }",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.3,\n          \"summary\": \"6 test files passed, 104 tests passed on the STA-4965 candidate. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"\n        }",
        "Audit1396 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"ssh\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1396 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/simulator-palette-search.test.ts\",\n    \"assertions\": [\n      \"same-id local and remote simulator tabs appear once under their owning hosts\"\n    ]\n  }\n]",
        "Audit1402: src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts reduced. Loses repeated no-op frame store-notification budget; independent cross-runtime resource preservation remains. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts\",\"assertions\":[\"preserves a sibling runtime mirror under the same bare worktree id\"]}]",
        "Audit1494 removes use-open-tab-search.test.ts. Supplied host/worktree/title/ranking projections, simple subscription updates and result-array identity alarms are retired. No actual activation or navigation occurred in that suite. No equivalent replacement coverage or fresh Cmd-J gate validation is claimed. Historical receipts remain scoped to their original selectors.",
        "Audit1899 replays sealed Audit1895: workspace-session-schema.test.ts keeps only cross-workspace truncated-tab salvage and legacy browser-history cap normalization. Four current commands and testFiles retain that reduced source; no current assertionRef or active receipt selects it. SSH file-owner, isolated browser partition, launch/title/quick-command fields, recency, structured-chat/view-mode and remote browser identity hydration alarms are intentionally lost. Existing retired receipt strings and unrelated active receipts remain verbatim. No equivalent replacement, new Cmd-J gate execution, native simulator or remote/browser restore proof is claimed.",
        "Audit2192 retires the removed physical-SSH repository badge assertion from WorktreeJumpPalette.test.tsx and its exact historical failed oracle receipt. Current reduced test selectors and unrelated unit/E2E receipts remain; none was rerun by this source audit and equivalent coverage is not claimed. Original obsolete assertion object verbatim:\n{\n          \"file\": \"src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx\",\n          \"assertions\": [\n            \"a runtime-owned worktree row never renders repository metadata borrowed from its physical SSH host\"\n          ]\n        }\nOriginal dated failed receipt object verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 5.1,\n          \"summary\": \"With the component's physical-host prelookup restored, the rendered palette oracle failed 1/12: the runtime-owned row displayed the physical SSH repository badge.\"\n        }",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3301 removes the orphaned mobile file-close fallback and ordinary cross-content MRU examples from tabs-open-close-lifecycle.test.ts. Earlier descriptions of retained MRU coverage are historical. The integrated mobile markdown close/frame-settlement case remains unchanged and is narrower. Preserve the existing administrative failed receipt and all complete retired receipts verbatim, along with selectors and unrelated assertions; no equivalent replacement or fresh Cmd-J, native or remote result is claimed.",
        "Audit3359 retires the whole ensure-simulator-tab-behavior suite: host-collision reuse, host stamping, inactive creation and unknown-owner routing alarms are intentionally lost without equivalent replacement. Its standalone command is removed and four compound commands narrowed. Three complete dated receipts selecting that source through currentCommand are retired verbatim, including their compound historical selectors; no retained test inherits their validation. Seven unrelated macOS receipts retain their original scope. No fresh runtime/UI, simulator, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\"",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts src/renderer/src/lib/simulator/launch/open-mobile-emulator-tab.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\"",
        "Audit3359 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\"",
        "Audit3359 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\",\n          \"assertions\": [\n            \"same-id folder simulator reuse selects the active owning host\",\n            \"inactive local simulator creation remains host-stamped amid a collision\",\n            \"an explicitly owned simulator is reused before its matching worktree row hydrates\"\n          ]\n        }",
        "Audit3359 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 0.8,\n          \"summary\": \"The final-review oracle failed 4/16 before the follow-up: same-id folder simulator reuse selected no owning tab, inactive local simulator creation was unstamped, the paired SSH/runtime alias resolved local metadata, and an explicit unknown owner fell back locally. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\"\n        }",
        "Audit3359 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/palette-repo-resolution.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 0.1,\n          \"summary\": \"The final reviewer repo-label oracle failed 1/6 before the follow-up: a paired SSH worktree resolved the local bare-id repository instead of its runtime-owned repository. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\"\n        }",
        "Audit3359 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/palette-repo-resolution.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 0.1,\n          \"summary\": \"The final clean-round fail-closed oracle failed 1/7 before the follow-up: an unavailable explicit runtime owner borrowed physical SSH repository metadata. Historical command preserved after the test-value audit removed the palette repo resolver suite. currentCommand is an administrative link to a remaining gate command; this historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/simulator/tabs/ensure-simulator-tab-behavior.test.ts\"\n        }",
        "Audit3381 intentionally removes the entire Cmd-J host-qualified candidate-ownership suite and its active selectors/assertion. The hidden same-id sibling ambiguity regression alarm is lost without replacement. The complete original dated failed receipt below is retired verbatim, including both command and currentCommand, rather than reassigned as validation of remaining selectors. Other complete receipts retain their exact original scopes; remaining browser/simulator/workspace/e2e selectors do not imply equivalent ownership protection. No fresh execution is claimed.\nOriginal active selector fields (historical raw native JSON values):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts src/renderer/src/lib/simulator/launch/open-mobile-emulator-tab.test.ts src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts src/shared/workspace-session/workspace-session-schema.test.ts\",\n        \"pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts\",\n        \"src/renderer/src/components/worktree-jump/WorktreeJumpPalette.test.tsx\",\n        \"src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts\",\n        \"src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts\",\n        \"src/renderer/src/lib/simulator/search/simulator-palette-search.test.ts\",\n        \"src/renderer/src/lib/browser/palette/browser-page-palette-activation.test.ts\",\n        \"src/renderer/src/lib/simulator/tabs/simulator-tab-palette-activation.test.ts\",\n        \"src/renderer/src/lib/simulator/launch/open-mobile-emulator-tab.test.ts\",\n        \"src/renderer/src/runtime/web-session-tabs-sync/identity/web-session-tabs-sync-mirror-identity.test.ts\",\n        \"tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts\",\n        \"src/shared/workspace-session/workspace-session-schema.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts\",\n          \"assertions\": [\"same-id local and SSH worktrees keep separate review-index results\"]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts\",\n          \"assertions\": [\n            \"scoped open-tab search keeps a hidden same-id sibling in the legacy ownership ambiguity set\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/browser/palette/browser-palette-page-entries.test.ts\",\n          \"assertions\": [\n            \"same-id local and remote browser tabs appear once under their owning hosts\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts\",\n          \"assertions\": [\n            \"both browser selections activate and render their owning host and workspace\",\n            \"both simulator selections activate and render their owning host and group\"\n          ]\n        }\n      ]\nComplete retired dated receipt (verbatim native JSON object):\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 1.8,\n          \"summary\": \"The first review-round oracle failed 4/40: browser and simulator dropped the SSH worktree's paired-runtime-owned tab, generic workspace rows attributed the remote tab to local, and active local tab creation left ownership unstamped. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/workspace/search/palette/cmd-j-host-qualified-candidate-ownership.test.ts\"\n        }"
      ],
      "demotionRule": "Cannot promote if a same-id sibling tab duplicates, disappears, activates another host, or if ambiguous unstamped ownership is guessed."
    },
    {
      "id": "ephemeral-vm-runtime.rollback-readable-sidecar",
      "title": "VM lifecycle stays rollback-readable and cleanup-retryable",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "ephemeral-vm-runtime-store",
      "layer": "desktop-main-persistence",
      "surfaces": [
        "VM runtime sidecar",
        "recipe lifecycle",
        "cleanup retry",
        "provisioned-root direct SSH"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["orca-server", "direct-ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["orca-server", "direct-ssh"],
      "coverageNotes": "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The recipe-process suite loses its three-row UTF-8 tail-cap subprocess sample; keep the original POSIX process-group timeout case proving descendant death, with Windows explicitly skipped. The active synchronous-graceful-termination assertion reference was already absent from the adopted original source before this reduction; it is preserved verbatim in knownGaps as historical stale metadata rather than replaced by a different claim. Unrelated cross-version rollback receipt and all prior narratives remain exact. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The rollback suite retains only exact preservation of an unknown future-version provisioning file and refusal of a new provisioning upsert. It retires malformed/oversized/merge/migration and old-reader schema projection examples; no actual old client runtime was executed by those removed cases. The IPC suite retains the immutable recipe snapshot used by an actual destroy child after plugin removal; other IPC validation/lifecycle projections are retired. Existing unrelated pinned rollback reproduction receipt retains its original scope. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. The runtime-service source intentionally loses14of16cases: ordinary lifecycle/retry/configuration/cleanup projections, unreadable-companion refusal and successful post-create compensation examples are retired. Keep only non-JSON credential refusal before provider launch and failed compensation after post-create persistence failure, with old-readable recovery identity across two local injected faults. This does not prove a subsequent retry or actual remote provider cleanup. Existing unrelated rollback reproduction receipt remains exact; no fresh execution, protection change or equivalent replacement claimed.  Audit 3292 retires the direct-SSH failed-project retention, managed-server failed-project retention and ordinary confirmed managed-VM destruction/no-repo.rm examples from repos-ephemeral-vm-cleanup-retention.test.ts. Host-scoped same-workspace isolation and stale renderer catalog reconciliation remain byte-identical. These three supplied-result alarms are intentionally lost without equivalent replacement. Existing selectors/assertionRefs, unrelated cross-version rollback receipt and archived complete 122-case cleanup receipt remain exact; no fresh broad runtime, provider, platform or mixed-version result is claimed. Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts: removes the imported project setup before destroying its VM; retains the VM when setup deletion throws; retains the VM when setup deletion reports no result. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts\",\n          \"assertions\": [\"failed or unconfirmed project-host rollback prevents provider destroy\"]\n        } Historical prior account (preserved verbatim): Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1441 removes the complete renderer VM-runtime settings suite: display filter/status/SSH-retry flags, cleanup and stop RPC-to-toast/dialog plumbing, manual-copy plumbing and polling toast silence. The suite did not execute provider teardown or process cancellation. Its rendered stop/retry and hidden-SSH display alarms are intentionally retired; no equivalent replacement or fresh reduced-selector runtime result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts: Loses wrapper-level host rebinding, incompatible provisioned-root refusal and best-effort cleanup-call alarms; all are mock-only orchestration projections. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A pinned exact-source harness runs the pre-#14352 reader and lifecycle service against baseline, affected-main, candidate, and fix-reverted stores. Platform-neutral tests cover store compatibility, user-cancellable cleanup, branch/ref adoption; audit885 removes the direct resume ownership predicate alarms. The direct-SSH provisioned-root Electron journey remains the live transport and destroy proof; this desktop sidecar is not mobile-facing and changes no RPC or remote wire payload. The test-value audit removed the renderer provisioned-root create-options suite. Its two incomplete-identity rejection assertions are lost: one omitted workspaceRunContext and other identity fields, and one supplied the context but omitted ephemeralVmExpectedRefHead. The suite did not test successful option mapping. Retained source-ref and lifecycle suites do not establish equivalent renderer guard coverage. Audit1342: src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts removed. Runtime/SSH ownership, encoded target, retry/failure/listing-error cleanup projection samples disappear. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4274",
        "https://github.com/stablyai/orca/pull/14352",
        "https://github.com/stablyai/orca/issues/13044"
      ],
      "invariant": "A sidecar written by the new build cannot make the previous production build lose otherwise compatible VM runtimes. Downgrade lifecycle writes remain authoritative after re-upgrade, provisioned-root metadata remains recoverable, and corrupt or future feature metadata is preserved without poisoning the rollback-readable v1 store. Destroy attempts have no automatic wall-clock cutoff; a user stop terminates the process tree, retains cleanup ownership, and permits a fresh retry. Provider failure retains the SSH/project context needed for safe cleanup. Unrecoverable recipe context releases only the hidden SSH registration while preserving lifecycle/provider metadata. Provisioned-root create receives the source ref's pinned commit, adoption verifies the requested branch/ref, and resume preserves the connection mode plus stable SSH ownership identity while allowing endpoint rotation.",
      "oracle": "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The recipe-process suite loses its three-row UTF-8 tail-cap subprocess sample; keep the original POSIX process-group timeout case proving descendant death, with Windows explicitly skipped. The active synchronous-graceful-termination assertion reference was already absent from the adopted original source before this reduction; it is preserved verbatim in knownGaps as historical stale metadata rather than replaced by a different claim. Unrelated cross-version rollback receipt and all prior narratives remain exact. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The rollback suite retains only exact preservation of an unknown future-version provisioning file and refusal of a new provisioning upsert. It retires malformed/oversized/merge/migration and old-reader schema projection examples; no actual old client runtime was executed by those removed cases. The IPC suite retains the immutable recipe snapshot used by an actual destroy child after plugin removal; other IPC validation/lifecycle projections are retired. Existing unrelated pinned rollback reproduction receipt retains its original scope. Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. The runtime-service source intentionally loses14of16cases: ordinary lifecycle/retry/configuration/cleanup projections, unreadable-companion refusal and successful post-create compensation examples are retired. Keep only non-JSON credential refusal before provider launch and failed compensation after post-create persistence failure, with old-readable recovery identity across two local injected faults. This does not prove a subsequent retry or actual remote provider cleanup. Existing unrelated rollback reproduction receipt remains exact; no fresh execution, protection change or equivalent replacement claimed.  Audit 3292 retires the direct-SSH failed-project retention, managed-server failed-project retention and ordinary confirmed managed-VM destruction/no-repo.rm examples from repos-ephemeral-vm-cleanup-retention.test.ts. Host-scoped same-workspace isolation and stale renderer catalog reconciliation remain byte-identical. These three supplied-result alarms are intentionally lost without equivalent replacement. Existing selectors/assertionRefs, unrelated cross-version rollback receipt and archived complete 122-case cleanup receipt remain exact; no fresh broad runtime, provider, platform or mixed-version result is claimed. Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts: removes the imported project setup before destroying its VM; retains the VM when setup deletion throws; retains the VM when setup deletion reports no result. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts\",\n          \"assertions\": [\"failed or unconfirmed project-host rollback prevents provider destroy\"]\n        } Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Write one ordinary schema-v1 runtime and one provisioned-root runtime. Require the exact pre-#14352 reader to return both, run the old destroy lifecycle against the projected provisioned record, then require the candidate to retain the cleaned state while restoring schema-v2 and checkout-mode metadata. The same old reader must reject affected-main and fix-reverted bytes. Malformed, oversized, unknown-record, and future-version feature sidecars must leave rollback-compatible records accessible and must not be overwritten during compatible lifecycle mutations. Require destroy to have no implicit deadline, stop a hung destroy through the public desktop action, require cleanup_failed plus a fresh successful retry, prove provider or project-host rollback failure retains every ownership record required to retry, and prove missing recipe context cannot leave an unremovable hidden SSH registration. Supply the source ref's captured commit to create, reject a provisioned checkout on the wrong branch/ref, and reject a resume that changes connection mode or SSH ownership.",
      "commands": [
        "node config/scripts/runtime-verification/ephemeral-store/run-ephemeral-vm-runtime-store-rollback-repro.mjs config/scripts/runtime-verification/ephemeral-store/ephemeral-vm-runtime-store-cross-version.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/ephemeral-vm-runtime-store.test.ts src/shared/ephemeral-vm-runtime-store-rollback.test.ts src/shared/ephemeral-vm-recipe-process.test.ts src/main/ephemeral-vm/runtime-service.test.ts src/main/ephemeral-vm/recipe-runner.test.ts src/main/ephemeral-vm/runtime-ssh-cleanup.test.ts src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts src/main/ipc/ephemeral-vm-provision-cancel.test.ts src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts src/main/ipc/ephemeral-vm.test.ts src/renderer/src/store/repos/repos-ephemeral-vm-cleanup-retention.test.ts",
        "pnpm exec playwright test tests/e2e/ephemeral-vm-cleanup-retry.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "config/scripts/runtime-verification/ephemeral-store/ephemeral-vm-runtime-store-cross-version.test.ts",
        "config/scripts/runtime-verification/ephemeral-store/run-ephemeral-vm-runtime-store-rollback-repro.mjs",
        "src/shared/ephemeral-vm-runtime-store-rollback.test.ts",
        "src/shared/ephemeral-vm-runtime-store.test.ts",
        "src/shared/ephemeral-vm-recipe-process.test.ts",
        "src/main/ephemeral-vm/runtime-service.test.ts",
        "src/main/ephemeral-vm/recipe-runner.test.ts",
        "src/main/ephemeral-vm/runtime-ssh-cleanup.test.ts",
        "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts",
        "src/main/ipc/ephemeral-vm-provision-cancel.test.ts",
        "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts",
        "src/main/ipc/ephemeral-vm.test.ts",
        "src/renderer/src/store/repos/repos-ephemeral-vm-cleanup-retention.test.ts",
        "tests/e2e/ephemeral-vm-cleanup-retry.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "config/scripts/runtime-verification/ephemeral-store/ephemeral-vm-runtime-store-cross-version.test.ts",
          "assertions": [
            "the exact rollback reader accepts both projected records",
            "the rollback lifecycle service destroys the provisioned resource using schema-v1 provider data",
            "re-upgrade restores provisioned-root metadata without reverting lifecycle state"
          ]
        },
        {
          "file": "src/shared/ephemeral-vm-runtime-store-rollback.test.ts",
          "assertions": [
            "unknown future-version provisioning metadata is preserved byte-for-byte and a new provisioning upsert refuses"
          ]
        },
        {
          "file": "src/main/ephemeral-vm/runtime-service.test.ts",
          "assertions": [
            "failed destroy persists a durable rollback-readable cleanup recovery record"
          ]
        },
        {
          "file": "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts",
          "assertions": [
            "unrecoverable recipe context releases the hidden SSH registration but preserves failed lifecycle state"
          ]
        },
        {
          "file": "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts",
          "assertions": [
            "selected source ref commit is captured before provider create",
            "the create recipe receives both the symbolic ref and its pinned commit",
            "multi-remote bases pair the selected remote URL with a fetchable branch ref",
            "an unresolved source ref rejects before provider create"
          ]
        },
        {
          "file": "src/main/ipc/ephemeral-vm-provision-cancel.test.ts",
          "assertions": ["cancellation during source-ref resolution aborts before provider create"]
        },
        {
          "file": "tests/e2e/ephemeral-vm-cleanup-retry.spec.ts",
          "assertions": [
            "the rendered runtime row stops a live cleanup process without an automatic deadline and a retry succeeds"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-14",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/run-ephemeral-vm-runtime-store-rollback-repro.mjs config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts",
          "currentCommand": "node config/scripts/runtime-verification/ephemeral-store/run-ephemeral-vm-runtime-store-rollback-repro.mjs config/scripts/runtime-verification/ephemeral-store/ephemeral-vm-runtime-store-cross-version.test.ts",
          "result": "passed",
          "durationSeconds": 11,
          "summary": "The pinned baseline and affected-main oracles passed, candidate downgrade ran the exact old destroy service, candidate re-upgrade retained lifecycle state, and both affected-main and fix-reverted bytes failed the old reader as expected."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic contract runs are stable. Two local Electron attempts reached successful adoption and terminal use, then hit the existing final context-menu detach; the immediate build-reuse rerun completed removal and destroy. CI soak history has not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2056 retires the exact deleted-source assertion alarms recorded in knownGaps; prior changed-source red/green claims are historical. Unrelated retained-source evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The same pinned oracle passes the pre-#14352 ordinary store, fails the affected-main mixed store with file-is-invalid, passes the candidate mixed store plus old-service destroy and re-upgrade, and fails again when the candidate compatibility files are reverted to affected main."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Ordinary writes remain byte-identical and create no feature sidecar. Reads add one bounded feature-file existence check; sorted feature comparisons avoid unchanged rewrites, and durable companion writes occur only when compatibility metadata changes. Cleanup adds one constant-size in-flight controller per active destroy and no automatic deadline; the visible settings section polls once per second only while cleanup is active. Provisioning adds one source-host Git ref-resolution command only when a ref was requested and runs it before provider create; adoption adds no remote subprocess beyond its existing checkout probes, and resume adds only in-memory comparisons."
      },
      "promotionCriteria": [
        "Keep the pinned baseline/latest/candidate/revert oracle green in CI.",
        "Keep the Docker provisioned-root create/adopt/terminal/remove/destroy journey green.",
        "Keep user-stopped destroy, fresh retry, and retained-context failure tests green.",
        "Collect soak history without unexplained lifecycle or sidecar flakes."
      ],
      "knownGaps": [
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1441 removes the complete renderer VM-runtime settings suite: display filter/status/SSH-retry flags, cleanup and stop RPC-to-toast/dialog plumbing, manual-copy plumbing and polling toast silence. The suite did not execute provider teardown or process cancellation. Its rendered stop/retry and hidden-SSH display alarms are intentionally retired; no equivalent replacement or fresh reduced-selector runtime result is claimed.",
        "No packaged-build downgrade installer journey; the exact released source reader and service are executed in-process.",
        "The obsolete provisioned-root SSH adoption unit suite was retired; it no longer supplies branch/ref adoption evidence. Historical run commands and counts are preserved, and no replacement equivalence is claimed.",
        "Live Docker SSH evidence runs locally on macOS and in the changed-file PR E2E lane on Ubuntu; Windows desktop behavior is covered by the platform-neutral filesystem codec and package job.",
        "The test-value audit removed the renderer provisioned-root create-options suite. Its two incomplete-identity rejection assertions are lost: one omitted workspaceRunContext and other identity fields, and one supplied the context but omitted ephemeralVmExpectedRefHead. The suite did not test successful option mapping. Retained source-ref and lifecycle suites do not establish equivalent renderer guard coverage.",
        "Audit1342: src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts removed. Runtime/SSH ownership, encoded target, retry/failure/listing-error cleanup projection samples disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/ephemeral-vm-runtime-store.test.ts src/shared/ephemeral-vm-runtime-store-rollback.test.ts src/shared/ephemeral-vm-recipe-process.test.ts src/main/ephemeral-vm-runtime-service.test.ts src/main/ephemeral-vm-resume-integrity.test.ts src/main/ephemeral-vm-recipe-runner.test.ts src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts src/main/ipc/ephemeral-vm-provision-cancel.test.ts src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts src/main/ipc/ephemeral-vm.test.ts src/main/provisioned-root-ssh-adoption.test.ts src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts src/renderer/src/lib/provisioned-root-create-options.test.ts src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"One hundred twenty-two focused store, recipe-process, lifecycle, cleanup-handler, rendered stop-action, retry-context, source-ref, adoption-integrity, resume-integrity, and provisioning-recovery tests passed.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/ephemeral-vm-runtime-store.test.ts src/shared/ephemeral-vm-runtime-store-rollback.test.ts src/shared/ephemeral-vm-recipe-process.test.ts src/main/ephemeral-vm/runtime-service.test.ts src/main/ephemeral-vm/recipe-runner.test.ts src/main/ephemeral-vm/runtime-ssh-cleanup.test.ts src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts src/main/ipc/ephemeral-vm-provision-cancel.test.ts src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts src/main/ipc/ephemeral-vm.test.ts src/renderer/src/components/settings/virtual-machines/runtimes/EphemeralVmRuntimesSection.test.tsx src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\",\"windows\"],\"coveredProviders\":[\"orca-server\",\"direct-ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts\",\n    \"assertions\": [\n      \"provider failure retains runtime-owned SSH targets and confirmed success releases them\",\n      \"unknown runtime inventory retains an explicitly requested target\"\n    ]\n  }\n]",
        "Audit1417 intentionally deletes src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts: Loses wrapper-level host rebinding, incompatible provisioned-root refusal and best-effort cleanup-call alarms; all are mock-only orchestration projections. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1853 accepts removal of the runtime-ssh-cleanup.test.ts alarm for repairing cleanup_failed/provider-succeeded records that already lack a target ID. No equivalent replacement coverage is claimed. Keep the surviving cleanup selector and unchanged cross-version rollback receipt; the historical 2026-08-14 122-case cleanup receipt remains archived verbatim in knownGaps.",
        "Audit1863 removes the standalone default-source-ref provisioning example. Its direct default-ref pinning alarm is intentionally lost; selected-ref pinning and invalid-ref cases remain without an equivalent replacement claim. Focused survivor execution does not validate the broad rollback selector or physical cross-version provisioning. Existing receipts retain their original commands and counts.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts: removes the imported project setup before destroying its VM; retains the VM when setup deletion throws; retains the VM when setup deletion reports no result. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts\",\n          \"assertions\": [\"failed or unconfirmed project-host rollback prevents provider destroy\"]\n        }",
        "Audit 3292 retires the direct-SSH failed-project retention, managed-server failed-project retention and ordinary confirmed managed-VM destruction/no-repo.rm examples from repos-ephemeral-vm-cleanup-retention.test.ts. Host-scoped same-workspace isolation and stale renderer catalog reconciliation remain byte-identical. These three supplied-result alarms are intentionally lost without equivalent replacement. Existing selectors/assertionRefs, unrelated cross-version rollback receipt and archived complete 122-case cleanup receipt remain exact; no fresh broad runtime, provider, platform or mixed-version result is claimed.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. The runtime-service source intentionally loses14of16cases: ordinary lifecycle/retry/configuration/cleanup projections, unreadable-companion refusal and successful post-create compensation examples are retired. Keep only non-JSON credential refusal before provider launch and failed compensation after post-create persistence failure, with old-readable recovery identity across two local injected faults. This does not prove a subsequent retry or actual remote provider cleanup. Existing unrelated rollback reproduction receipt remains exact; no fresh execution, protection change or equivalent replacement claimed.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes.",
        "Audit3413 retires two runtime-service assertion claims after source reduction; the failed-destroy durable rollback-readable cleanup recovery claim remains current. Complete prior assertionRef preserved as historical data only: {\n          \"file\": \"src/main/ephemeral-vm/runtime-service.test.ts\",\n          \"assertions\": [\n            \"an unreadable companion rejects checkout-mode recipes before their create command runs\",\n            \"post-create persistence failure destroys the provider resource when possible\",\n            \"failed destroy persists a durable rollback-readable cleanup recovery record\"\n          ]\n        }",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The rollback suite retains only exact preservation of an unknown future-version provisioning file and refusal of a new provisioning upsert. It retires malformed/oversized/merge/migration and old-reader schema projection examples; no actual old client runtime was executed by those removed cases. The IPC suite retains the immutable recipe snapshot used by an actual destroy child after plugin removal; other IPC validation/lifecycle projections are retired. Existing unrelated pinned rollback reproduction receipt retains its original scope.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3446 archived original assertionRef after source reduction; historical scope only, raw original object follows:\n{\n          \"file\": \"src/shared/ephemeral-vm-runtime-store-rollback.test.ts\",\n          \"assertions\": [\n            \"malformed, future, oversized, and unknown feature data is preserved without poisoning v1 records\",\n            \"current-main poisoned bytes migrate to a rollback-readable projection\"\n          ]\n        }",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The recipe-process suite loses its three-row UTF-8 tail-cap subprocess sample; keep the original POSIX process-group timeout case proving descendant death, with Windows explicitly skipped. The active synchronous-graceful-termination assertion reference was already absent from the adopted original source before this reduction; it is preserved verbatim in knownGaps as historical stale metadata rather than replaced by a different claim. Unrelated cross-version rollback receipt and all prior narratives remain exact. All prior notes and archived receipts retain original scopes.",
        "Audit3456 preserves this pre-existing stale assertion reference verbatim as historical metadata only; the synchronous termination case was already absent from exact adopted base before this reduction: {\n          \"file\": \"src/shared/ephemeral-vm-recipe-process.test.ts\",\n          \"assertions\": [\n            \"synchronous graceful termination settles cancellation and clears the force-kill timer\"\n          ]\n        }"
      ],
      "demotionRule": "Demote if a new write fails the pinned rollback reader, a downgrade lifecycle mutation is lost after re-upgrade, malformed/future metadata overwrites recoverable bytes, ordinary v1 bytes change, user stop cannot settle a destroy process tree, cleanup loses retry ownership, an unrecoverable context leaves a permanent hidden SSH registration, or the focused gate flakes without an identified harness defect."
    },
    {
      "id": "terminal-session.shell-ready-exec-prompt-fallback",
      "title": "Startup exec falls back to the identified shell's line editor",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-session-readiness",
      "layer": "posix-pty-and-shell-startup",
      "surfaces": [
        "queued terminal startup commands",
        "zsh, bash, and Fish startup output",
        "Bash PROMPT_COMMAND lifecycle composition"
      ],
      "platforms": ["macos", "linux"],
      "providers": ["local", "local-daemon", "ssh-daemon", "ssh-relay", "paired-runtime"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": ["local", "local-daemon", "ssh-relay", "paired-runtime"],
      "coverageNotes": "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. A real Fish PTY proves marker stripping is byte-exact and does not render bracketed-paste control text. Ubuntu 20.04/Bash 5.0 and Ubuntu 24.04/Bash 5.2 containers cover scalar and array PROMPT_COMMAND composition, including real zoxide on 24.04. Deterministic owner contracts cover local, daemon, and SSH relay identity/readiness composition plus provider-owned delivery; explicit terminal-paste remains renderer-owned. Live isolated journeys cover a macOS headed desktop owner with paired web client, headless orca serve with paired web client, and a Docker Linux OpenSSH/Bash target with one readiness-time reconnect. Linux desktop, WSL/Windows, live zsh-over-SSH, and physical remote hosts remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/13767",
        "https://linear.app/stably/issue/STA-4067",
        "https://linear.app/stably/issue/STA-4068",
        "https://github.com/stablyai/orca/pull/14161",
        "https://github.com/stablyai/orca/issues/14448",
        "https://linear.app/stably/issue/STA-4292",
        "https://github.com/stablyai/orca/pull/14451"
      ],
      "invariant": "Shell startup scanning preserves every non-Orca output byte in order across arbitrary PTY chunk boundaries. Bash scalar and supported array PROMPT_COMMAND values preserve user bytes, hook order, and foreground exit status while emitting exactly one OSC 133 A/C/D lifecycle without syntax errors. Before user startup files run, the wrapper publishes its shell PID. If a later exec discards the ready marker, proof-based recovery releases queued startup input only after the launched shell's actual executable image with that exact PID owns the PTY foreground, emits its post-hook line-editor enable sequence, and exposes zle/readline termios; startup reads, line-init hooks, child foreground processes, and non-shell readline replacements cannot trigger that proof. The existing bounded compatibility timeout may enqueue input without proof, but must not publish readiness, lose or duplicate that input across reconnect, or execute it before the replacement shell can accept it.",
      "oracle": "Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Split Fish output immediately after the ready marker and after the following ESC introducer; local and daemon owners must emit the exact ESC [ ? 2004 h bytes and headless xterm must not render literal control text. Run the real generated wrappers under node-pty with disposable zsh, bash, and Fish startup files. Exercise Bash scalar and array PROMPT_COMMAND values with empty, repeated, escaped, whitespace, control-byte, odd-backslash, status-mutating, DEBUG-trap, zoxide, and RHEL-style hooks; require exact A,C,D:0,A,C,D:1,A,C ordering and byte preservation. Plain and exec -a replacement shells must receive one queued command at their first completed line editor without waiting for the 15-second timeout. The identical oracle must time out without the startup identity and prompt fallback. Same-shell reads, child-process reads, a blocking zle-line-init hook, sqlite3, and sqlite3 renamed zsh must not trigger prompt fallback. Relay owner coverage must use the same lossless scanner composition and release through the same prompt contract.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/daemon/shell-readiness/testing/bash-prompt-command-composition.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts src/shared/terminal/pty/native-process/shell-process-readiness.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-readiness/testing/shell-ready.test.ts src/main/pty/shell-startup/shell-startup-output-scanner.test.ts",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1"
      ],
      "testFiles": [
        "src/main/daemon/shell-readiness/testing/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
        "src/main/daemon/shell-readiness/testing/bash-prompt-command-composition.test.ts",
        "src/main/pty/shell-startup/line-editor-ready-output-scanner.test.ts",
        "src/main/pty/shell-startup/shell-startup-identity-scanner.test.ts",
        "src/main/pty/shell-startup/shell-startup-output-scanner.test.ts",
        "src/shared/terminal/pty/native-process/pty-slave-line-discipline-echo.test.ts",
        "src/shared/terminal/pty/native-process/shell-process-readiness.test.ts",
        "src/main/daemon/sessions/testing/session.test.ts",
        "src/main/daemon/shell-readiness/testing/shell-ready.test.ts",
        "src/main/providers/local-pty/local-pty-shell-ready-marker-scan.test.ts",
        "src/main/providers/local-pty/local-pty-shell-ready-startup-command.test.ts",
        "src/main/providers/local-pty/local-pty-shell-ready-wrapper-generation.test.ts",
        "tests/e2e/paired-startup-exec-readiness.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/pty/shell-startup/shell-startup-output-scanner.test.ts",
          "assertions": [
            "Fish bracketed-paste output stays byte-exact across marker and ESC chunk splits",
            "every byte after readiness is preserved across every chunk boundary, even when it resembles an identity marker",
            "pre-ready identity and readiness markers strip across every chunk boundary without reordering prompt output",
            "incomplete scanner prefixes drain in byte order"
          ]
        },
        {
          "file": "tests/e2e/paired-startup-exec-readiness.spec.ts",
          "assertions": [
            "a headed desktop owner and paired client recover startup exec on one stable owning PTY",
            "an isolated headless orca serve owner provides the same exact-once output and input contract"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 14,
          "summary": "The shared oracle passed a headed desktop owner plus paired web client and an isolated headless orca serve owner plus paired web client."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused local wrapper contracts plus isolated SSH and paired live journeys"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Fresh deterministic and isolated live runs pass locally; CI and soak history have not started."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Daemon oracle SHA-256 b13b08006a38b2adc2acb51ae9342909514e55ab4822fac4fbb76cd49b344cc6 was byte-identical across runs: affected baseline 09ec516ae5 failed 4 of 14, while pre-PR main bc2e30000b and this PR passed 14 of 14. The unchanged live SSH oracle failed on bc2e30000b and with the ownership change reverted because the ledger stayed pending after reconnect, then passed on this PR. Fish chunk oracle patch SHA-256 fd49a4d3d91bd5f0d10c1b1f44f4cfbd92cef9155a5505b415c8680184cdc765 was also byte-identical: scan target e4c278eb52, main 150cc6f50c, and candidate ae7f30318a with shared scanner integration disabled failed only the ESC-introducer split in local and daemon owners, while ae7f30318a passed all 163 cases plus headless-xterm rendering."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Two bounded linear scans partition identity ownership at the exact ready-marker boundary and retain only the existing bounded prefixes. The normal ready-marker path cancels before external probing. A missing marker triggers a debounced stty read only after a line-editor enable sequence, followed by narrow PID status and executable-image inspection only when termios matches. Slow ordinary startup output triggers zero probes; rejected protocol emissions are capped at four probes per startup. There is no per-command hook or steady-state polling."
      },
      "promotionCriteria": [
        "Collect CI and soak history for the Docker SSH and paired live journeys.",
        "Collect CI and soak history without unexplained flakes.",
        "Keep same-shell, child-process, line-init-hook, and non-shell readline contracts green."
      ],
      "knownGaps": [
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The fallback requires a readable POSIX PTY slave; WSL through wsl.exe, ConPTY, and native Windows retain the existing timeout backstop.",
        "The live SSH journey covers Docker Linux OpenSSH with Bash, not zsh, WSL, Windows SSH, a Linux desktop renderer, or a physical remote host.",
        "An exec integration that forks a replacement shell instead of retaining the identified shell PID retains the existing timeout backstop.",
        "A zsh configuration that disables bracketed-paste output emits no safe post-hook protocol signal and retains the existing timeout backstop.",
        "The pre-existing timeout backstop can still deliver queued input to a non-shell replacement after it expires; this fallback prevents indefinite startup hangs and is unchanged by the prompt fallback.",
        "The fallback restores safe startup-command delivery but cannot recreate OSC 133 hooks or overlay restores already discarded by exec.",
        "Startup code running in the launched shell can deliberately spoof the public line-editor enable sequence after configuring matching termios; the existing timeout path already trusts a public OSC marker from the same startup code.",
        "Audit1878 removes the ptsName getter/shape table and mocked platform stty-argv table from pty-slave-line-discipline-echo.test.ts, and the unset-PATH sh-versus-/bin/sh helper comparison from shell-process-readiness.test.ts. Retained parser/probe promise state and real-filesystem/process tests have their original platform and injected-process limits; no equivalent replacement or fresh broad readiness-gate result is claimed."
      ],
      "demotionRule": "Keep experimental or demote if prompt fallback enters a normal, child, or line-init read; a non-shell executable triggers prompt fallback; the identified shell PID is not foreground; delivery duplicates; ordinary startup output spawns probes; probe attempts exceed four; or the focused gate flakes without an identified harness defect."
    },
    {
      "id": "editor.restored-sibling-owner-reparent",
      "title": "Restored sibling tabs migrate filesystem authority before becoming editable",
      "maturity": "experimental",
      "protection": "none",
      "owner": "editor-runtime",
      "layer": "renderer-store-controller-contract",
      "surfaces": [
        "restored editor tabs",
        "editor save and autosave",
        "filesystem watches and hot-exit persistence"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "paired-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3359 keeps two restored-editor-owner-reparent cases covering coupled dirty-editor/draft/preview/main-group migration and hot-exit serialization/hydration. The subscribed activation, collision refusal and mounted watch replacement/destination-event correlation alarms are intentionally lost without equivalent replacement. The complete compound dated receipt is retired verbatim. With no active receipt, protection and covered scope are cleared and prospective command/test-file/assertion selectors are retired; their complete originals and prior red/green/flake accounts remain historical in knownGaps. The retained reparent cases and unchanged save-lifecycle source remain reachable through broad unit execution, not active evidence for this gate. No fresh provider, filesystem restart, historical-import, mobile, mixed-version or cross-platform validation is claimed. Deterministic store/controller tests cover local, direct-SSH, paired-runtime identity, folder workspaces, queue quiescence, stale route and connection-generation rejection, authoritative active-workspace projection, owner-derived IDs, drafts and editor maps, tab/group placement, exact watch replacement, change/delete/rename correlation, explicit save, autosave, collision refusal without activation reconciliation, provenance, and restart hot-exit persistence. Live headed/headless paired-runtime and post-establish Electron IPC remain uncollected. The test-value audit removed the standalone runtime-workspace file-route suite. Its direct same-host sibling, folder-root, exact-SSH, outside-path and directory-routing alarms are lost. Retained editor lifecycle contracts do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit narrows restored-editor-owner-reparent.test.ts by removing standalone unrelated-explorer-reveal, duplicate-tab repair/refusal, clean/dirty collision-table, watcher-target projection, folder-workspace context and direct-SSH provenance examples. Their exact scalar/ID/reference, selector and route/generation-field alarms are intentionally lost. The dirty collision variant did not assert preservation of its destination draft, and the main-owned duplicate-tab branch checked a synthetic missing-group refusal rather than duplicate repair. Remaining authored cases still check coupled dirty-state migration, subscribed activation, hot-exit roundtrip, rejection without destination reconciliation, mounted watch replacement and destination event correlation. They are not equivalent replacements for the deleted alarms. Historical executed commands, counts and results remain unchanged; no new live host, process restart or platform evidence is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11304",
        "https://github.com/stablyai/orca/pull/11369"
      ],
      "invariant": "A restored absolute path owned by a same-host sibling workspace cannot read, save, watch, or persist until old saves drain, the exact route and host generations are revalidated, and one authoritative activation transaction installs the sibling owner, target projection, editor state, reconciliation, and first-activation terminal preparation; collisions and stale routes fail before activation preparation or reconciliation.",
      "oracle": "Audit3359 keeps two restored-editor-owner-reparent cases covering coupled dirty-editor/draft/preview/main-group migration and hot-exit serialization/hydration. The subscribed activation, collision refusal and mounted watch replacement/destination-event correlation alarms are intentionally lost without equivalent replacement. The complete compound dated receipt is retired verbatim. With no active receipt, protection and covered scope are cleared and prospective command/test-file/assertion selectors are retired; their complete originals and prior red/green/flake accounts remain historical in knownGaps. The retained reparent cases and unchanged save-lifecycle source remain reachable through broad unit execution, not active evidence for this gate. No fresh provider, filesystem restart, historical-import, mobile, mixed-version or cross-platform validation is claimed. Hold an old-owner save in flight, start migration, then remove the sibling, change a folder root, or reconnect SSH and require owner migration to fail closed after quiescence. On a stable route require one coherent target-workspace projection, first-activation terminal generation preparation, destination authority for explicit save and autosave, exact watch replacement, destination-only change/delete/rename handling, owner-derived state rekeys, and hot-exit restart ownership. Seed an invalid destination tab/group model before a collision and require the target projection to remain byte-identical.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "focused renderer store/controller contract on a local development runner"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit3359 retires the sole dated compound receipt. No fresh execution or soak history validates the reduced selector; original flake account is preserved verbatim as history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit3359 changes the referenced test source and retires collision/watch/activation oracles. No fresh red/green proof applies to the reduced selector. The complete prior account is preserved verbatim in knownGaps as historical only."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Route lookup scans only the already-indexed renderer workspace catalog, while migration is O(open editor files + source/destination tabs/groups) and performs no provider call, Git scan, polling, retry, subprocess, or global fanout beyond the required old/new watch delta."
      },
      "promotionCriteria": [
        "Collect two fresh child-verifier decisions against the correction candidate.",
        "Collect headed and headless paired-runtime coverage after the post-establish Electron IPC gap is fixed.",
        "Collect physical Windows or WSL path/host evidence and CI soak history."
      ],
      "knownGaps": [
        "Headed Electron post-establish IPC, paired headless, reconnect, and physical Windows/WSL journeys are uncollected.",
        "Cold many-repo main-process sibling discovery remains a separately measured follow-up.",
        "Registered-workspace symlink policy remains inherited and unchanged.",
        "The test-value audit removed the standalone runtime-workspace file-route suite. Its direct same-host sibling, folder-root, exact-SSH, outside-path and directory-routing alarms are lost. Retained editor lifecycle contracts do not establish equivalent selector coverage; historical run commands and results remain historical.",
        "The test-value audit narrows restored-editor-owner-reparent.test.ts by removing standalone unrelated-explorer-reveal, duplicate-tab repair/refusal, clean/dirty collision-table, watcher-target projection, folder-workspace context and direct-SSH provenance examples. Their exact scalar/ID/reference, selector and route/generation-field alarms are intentionally lost. The dirty collision variant did not assert preservation of its destination draft, and the main-owned duplicate-tab branch checked a synthetic missing-group refusal rather than duplicate repair. Remaining authored cases still check coupled dirty-state migration, subscribed activation, hot-exit roundtrip, rejection without destination reconciliation, mounted watch replacement and destination event correlation. They are not equivalent replacements for the deleted alarms. Historical executed commands, counts and results remain unchanged; no new live host, process restart or platform evidence is claimed.",
        "Audit3359 keeps two restored-editor-owner-reparent cases covering coupled dirty-editor/draft/preview/main-group migration and hot-exit serialization/hydration. The subscribed activation, collision refusal and mounted watch replacement/destination-event correlation alarms are intentionally lost without equivalent replacement. The complete compound dated receipt is retired verbatim. With no active receipt, protection and covered scope are cleared and prospective command/test-file/assertion selectors are retired; their complete originals and prior red/green/flake accounts remain historical in knownGaps. The retained reparent cases and unchanged save-lifecycle source remain reachable through broad unit execution, not active evidence for this gate. No fresh provider, filesystem restart, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3359 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/store/slices/editor/hydration/restored-editor-owner-reparent.test.ts\",\n          \"assertions\": [\n            \"one atomic commit rekeys owner-derived editor, preview, draft, cursor, view, tab, group, active, reveal, focus, provenance, and persistence state\",\n            \"active reparenting uses the centralized workspace activation transaction for terminal, browser, pending-creation, explorer, first-activation, and post-commit state\",\n            \"source watch unsubscribes once, destination watch subscribes once, and only destination change/delete/rename events reach the file\",\n            \"a destination collision fails closed without changing current selection or reconciling destination tabs and groups\"\n          ]\n        }",
        "Audit3359 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts src/renderer/src/lib/runtime-workspace-file-route.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"Three deterministic files passed 20 lifecycle, stale-route, activation, ownership, host, collision, persistence, watch, and save tests.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/editor/hydration/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts\"\n        }",
        "Audit3359 historical original protection object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"partial\"",
        "Audit3359 historical original coveredPlatforms object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"macos\"]",
        "Audit3359 historical original coveredProviders object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"local\", \"ssh\", \"paired-runtime\"]",
        "Audit3359 historical original redGreenEvidence object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"complete\",\n        \"evidence\": \"The final2 verifier's byte-identical post-quiescence lifecycle scope passed 21/21 on 7890271160 and failed 7 tests on f92db196a1; base e08eba674c, published 1bcfe3bcb0, and revert b3627461ab were structurally red. The permanent collision oracle is in test blob ac62a89c671a0c8f081ebf06736715bd2150ce9f (SHA-256 a61970ace80be1cb56f781aee6f878a8446c6c4527f9eb0cd0c151d8df96bf50). The same byte-identical blob is structurally red on base, published, and revert, behaviorally red on rejected final2 candidate 7890271160 because pre-commit reconciliation removes the stale destination tab, and green on implementation b72a838cdc; the full permanent gate passes 20/20.\"\n      }",
        "Audit3359 historical original flakeHistory object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"unknown\",\n        \"evidence\": \"One local deterministic run is recorded; CI and soak history have not started.\"\n      }",
        "Audit3361 gate38 prospective commands selector retired; complete original preserved verbatim as historical only:\n[\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/editor/hydration/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts\"\n      ]",
        "Audit3361 gate38 prospective testFiles selector retired; complete original preserved verbatim as historical only:\n[\n        \"src/renderer/src/store/slices/editor/hydration/restored-editor-owner-reparent.test.ts\",\n        \"src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts\"\n      ]",
        "Audit3361 gate38 prospective assertionRefs selector retired; complete original preserved verbatim as historical only:\n[\n        {\n          \"file\": \"src/renderer/src/store/slices/editor/hydration/restored-editor-owner-reparent.test.ts\",\n          \"assertions\": [\n            \"coupled dirty-editor ID, draft, preview and main-group migration remains coherent\",\n            \"hot-exit serialization and hydration preserve migrated editor ownership and dirty state\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts\",\n          \"assertions\": [\n            \"migration waits for the old save queue and routes later explicit and automatic saves through the destination worktree\",\n            \"a removed sibling, changed folder root, or changed direct-SSH generation after quiescence rejects migration without changing ownership\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Keep experimental or demote if migration can race a save, retain source authority, fan out watches, lose dirty/editor state, accept an owner-generation change, merge a collision, or the focused contract flakes without a product or harness bug."
    },
    {
      "id": "terminal-provider.login-session-retirement",
      "title": "macOS login-session retirement preserves live daemons through transient rejection bursts",
      "maturity": "experimental",
      "protection": "none",
      "owner": "daemon-terminal",
      "layer": "macos-daemon-lifecycle",
      "surfaces": [
        "GUI-spawned macOS daemon",
        "local PTY survival",
        "daemon reconnect and replacement"
      ],
      "platforms": ["macos"],
      "providers": ["local-daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: A deterministic fake clock covers short-burst recovery, sustained session death, pending-timer and in-flight-probe suspension, event-trigger preemption, resolver corroboration, and shutdown cancellation. The production-only watch remains behind the macOS GUI launch flag; SSH/headless, WSL, Linux, Windows, mobile, and relay paths are unaffected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11749",
        "https://github.com/stablyai/orca/issues/7936"
      ],
      "invariant": "A GUI-spawned macOS daemon may retire for PAM rejections only after it previously accepted login wrapping, receives three conclusive rejections spanning at least one uninterrupted 120-second observation window, and observes explicitly unhealthy in-process resolver state. A conclusive acceptance or a sleep/App Nap-sized gap before or during a probe resets the rejection window to the periodic cadence, and client or PTY activity cannot shorten its scheduled backoff.",
      "oracle": "Arm the watch with an accepted probe, inject three rejections over 20 seconds plus unhealthy resolver state, then inject client and PTY activity and require zero resolver reads, zero retirement calls, and exactly four probes until the 120-second boundary. Return acceptance at that boundary and require the daemon to survive. Jump wall time by one hour while a timer is pending and while a PAM probe promise is unresolved; require rejection evidence to restart after wake, zero probes for the next 119,999 milliseconds, and recovery without retirement in both cases. Repeatedly delay timers beyond the suspension threshold for one hour and require the periodic probe bound, one live timer, and zero resolver or retirement calls. Separately keep rejecting through an uninterrupted boundary and require one retirement, while healthy or unknown resolver state suppresses it and stop aborts an in-flight resolver check.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "deterministic login-session death-watch state-machine suite"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic suite passes locally; focused CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "On origin/main, the field-shaped accepted then three-rejection sequence calls onRetire after 20 seconds and fails the recovery oracle. With the minimum observation window and non-preemptible rejection schedule, the identical oracle preserves the daemon and recovers at the boundary."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The watch retains one timer and one in-flight probe. A rejection burst runs the existing two 10-second confirmation probes, then one recovery probe at the 120-second boundary; client and PTY activity cannot pull that deadline earlier. Timer lateness and in-flight probe suspension both rebaseline evidence to the periodic cadence, preventing an App Nap retry loop, and resolver work is skipped until the time floor. No polling loop, startup await, session scan, renderer work, provider fanout, listener, or retained payload was added."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Capture field evidence from macOS sleep/wake and a full GUI logout without a false retirement or missed stale-session recovery.",
        "Keep the exact probe-count, no-early-resolver, trigger-preemption, acceptance-reset, and shutdown-abort assertions green."
      ],
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "A real dead macOS GUI login session cannot be fabricated without ending the runner's login session; sustained-death coverage uses deterministic PAM and resolver oracles.",
        "The two-minute production window and one-hour pending/in-flight suspension cases are covered by fake-clock tests rather than a real sleep/wake run.",
        "No multi-process aggregate throttle is added; each stale daemon independently obeys the same non-preemptible observation window."
      ],
      "demotionRule": "Keep experimental or demote if any activity trigger shortens the rejection window, a transient burst reaches resolver retirement authority, sustained dead-session evidence no longer converges, shutdown permits late retirement, or the focused gate flakes without an identified product or harness fault."
    },
    {
      "id": "ssh-filesystem.stream-inactivity-lifecycle",
      "title": "SSH file streams bound inactivity without counting host sleep",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "desktop-ssh",
      "layer": "ssh-file-stream-lifecycle",
      "surfaces": ["SSH filesystem reads", "AI Vault remote scanning", "system sleep/wake"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["ssh2", "system-ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["ssh2", "system-ssh"],
      "coverageNotes": "Deterministic fake-clock coverage proves inactivity cancellation, active-transfer renewal, sticky suspend replay before metadata, failure-isolated lifecycle fanout, committed-quit bridge disposal, timer cleanup, and listener cleanup. A real Docker SSH relay previously proved active and stalled transfer behavior; physical sleep/wake and Windows/Linux clients remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11362",
        "https://github.com/stablyai/orca/pull/11364"
      ],
      "invariant": "A non-empty SSH file stream that produces no valid frame for 30 seconds must cancel at its authoritative stream reader and release all local lifecycle state. System suspend is sticky across metadata and subscription races, resume grants every still-live stream one fresh inactivity window, one failing consumer cannot block the others, and the sole Electron bridge survives a vetoed before-quit without retaining a per-stream Electron listener.",
      "oracle": "Publish suspend before stream metadata resolves, jump wall time by one hour, and require the late-subscribing stream to remain pending until resume grants a fresh 30-second window. Deliver a valid final chunk and end frame, require exact content, then publish another resume and require zero timers, multiplexer listeners, or renewed work; separately require stalled cancellation at 30 seconds, atomic state replay, failure-isolated fanout, and bridge disposal only after the committed will-quit gate.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/power/system-resume-broadcast.test.ts src/main/power/system-power-lifecycle.test.ts --reporter=dot --maxWorkers=2"
      ],
      "testFiles": [
        "src/main/power/system-resume-broadcast.test.ts",
        "src/main/power/system-power-lifecycle.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/power/system-resume-broadcast.test.ts",
          "assertions": ["publishes suspend and resume to main-process lifecycle consumers"]
        },
        {
          "file": "src/main/power/system-power-lifecycle.test.ts",
          "assertions": [
            "replays suspended state to a late subscriber",
            "atomically replays a transition to a subscriber added during publication",
            "isolates a failing listener from the remaining subscribers"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-10-06",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/system-resume-broadcast.test.ts src/main/system-power-lifecycle.test.ts --reporter=dot --maxWorkers=2",
          "currentCommand": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/power/system-resume-broadcast.test.ts src/main/power/system-power-lifecycle.test.ts --reporter=dot --maxWorkers=2",
          "durationSeconds": 8.141,
          "summary": "The retained behavioral cohort passed 25 tests after removing source-only ordering tests. Historical pre-removal receipts are preserved verbatim with their originally executed commands: [{\"date\":\"2026-08-01\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/system-resume-broadcast.test.ts src/main/system-power-lifecycle.test.ts src/main/startup/desktop-startup-ordering.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":1.6,\"summary\":\"Four focused files and 33 tests passed, including stalled cancellation, active progress, late metadata replay, failure isolation, committed-quit bridge lifetime, and post-settlement cleanup.\"}] No new native desktop or hosted run is claimed."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "deterministic SSH file-stream and system power lifecycle unit tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic correction suite passes locally; focused CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical oracle is incomplete on origin/main because stalled streams never settle, and the pre-correction candidate cancels immediately after a simulated one-hour suspend. The corrected candidate bounds uninterrupted inactivity while granting a full post-resume window."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "One app-global powerMonitor listener publishes to an in-memory set. Each active non-empty read retains one set entry and one unref'd timer, clears both on settlement, and performs constant work per valid chunk; each power transition performs O(active streams) isolated notifications with no polling, provider scan, subprocess, renderer work, or per-stream Electron listener."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Capture physical macOS, Linux, and Windows sleep/wake evidence with a live SSH read.",
        "Keep timeout, post-resume renewal, and zero-retained-lifecycle assertions green."
      ],
      "knownGaps": [
        "Suspend/resume is injected at the authoritative main-process event seam rather than by physically sleeping the runner.",
        "Slow links that produce no complete valid frame for 30 uninterrupted awake seconds remain intentionally retryable failures."
      ],
      "demotionRule": "Keep experimental or demote if sleep consumes inactivity evidence, stalled streams become unbounded, or settled reads retain timers or lifecycle subscriptions."
    },
    {
      "id": "ssh-relay.staged-upload-recovery",
      "title": "SSH relay uploads and install locks remain retryable",
      "maturity": "experimental",
      "protection": "none",
      "owner": "ssh-relay-install",
      "layer": "ssh-transfer-install-contract",
      "surfaces": [
        "SSH relay first install",
        "split shell and SFTP namespaces",
        "system SSH transfer fallback",
        "relay install retry after cancellation",
        "post-promotion retry after execution-host restart"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["ssh2", "system-ssh"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2087 retires the sole pre-removal active receipt and covered scope; no passing current reduced-selector evidence is claimed. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Deterministic unit, exact POSIX shell, native ARM macOS PowerShell 7.6.4, and real ssh2 SFTP-wire tests cover lock ordering, concurrent-install loss, fixed-slot ownership identity, payload-only promotion, bounded stale-stage reclamation, boot-identity takeover, installed-fast-path draining, joined cancellation teardown, cross-version isolation, split-SFTP redirection, and system-SSH bypass. A throwaway linux-arm64 Docker sshd reached through a non-loopback LAN address covers live bytes-in-flight SFTP cancellation, injected unconfirmed cancellation, immediate retry against a real Git repository, fixed-slot recovery behind unclaimable entries, and real version-GC filtering with 15,197 unrelated names.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/9828",
        "https://github.com/stablyai/orca/pull/10207",
        "https://github.com/stablyai/orca/issues/17144"
      ],
      "invariant": "A first-install relay transfer must complete in an attempt-owned fixed staging slot before acquiring the shared version install lock. Reservation, promotion, confirmed cleanup, and stale recovery must reject path replacement, persisted-identity mismatch, POSIX symlinks, and Windows reparse points. A newly acquired install lock atomically records the execution host's boot identity; only a verified identity change or the existing stale-age proof may replace it, while legacy, missing, malformed, and unreadable identity state must retain the conservative stale fallback. Recovery examines only eight fixed slot/claim/delete names and removes at most one stale valid stage per call; eight unclaimable states fail with an explicit manual-recovery message. Split-SFTP hosts must prove the stage identity on the exact transfer session, only payload contents may be promoted under the shared lock, and cancellation must boundedly join SFTP, stream, local file-handle, and transfer settlement.",
      "oracle": "Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Pause a real ssh2 SFTP relay.js write after one remotely acknowledged chunk, prove the remote file is partial, abort the live transfer, and require no shared .install-lock, leaked local descriptor, or foreign-process termination. Separately inject two unconfirmed cancellations, require an independent deployment to install, launch, answer relay RPC, and read a real repository HEAD. Keep a fresh install lock on the current POSIX or Windows boot and require takeover to fail; replace its bounded identity with a prior-boot value and race concurrent recoverers, requiring exactly one atomic winner, a current successor identity, and no tombstone residue; omit the marker and require the legacy lock to remain fenced. Replace one retained fixed slot with an old-mtime same-owner directory while preserving the original, add a fixed-slot POSIX symlink, and require installed-path recovery to skip both while reclaiming a valid stale slot behind them. Add 15,197 unrelated relay-shaped names and run the real version GC, requiring bounded stdout and no removal. Unit and wire contracts cover exact POSIX and native PowerShell 0/1/7/8/9+ quota behavior, no-follow identity fencing, payload symlink/reparse rejection, one-item repeated draining, zero lock acquisition before upload settlement, joined transfer/channel teardown including never-settling failures, SFTP redirection, package.json namespace ownership, promotion only after the lock, cross-version isolation, and system-SSH behavior.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 35,
        "scope": "focused unit, SFTP-wire, and local Docker SSH contracts"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused deterministic and Docker runs pass locally; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "A byte-identical local Docker oracle run on latest main left a fresh shared .install-lock and blocked retry; the staged candidate left no shared lock and recovered immediately, and disabling staged ordering restored the blocked result. No committed baseline artifact or baseline installed-fast-path cleanup oracle is retained, so this evidence is intentionally not marked complete."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Stage recovery examines only eight fixed slot/claim/delete paths and reclaims at most one stale valid stage per invocation; installed reconnects launch before asynchronous recovery. Install-lock identity is recorded once per acquisition and checked only during the existing at-most-once-per-minute recovery probe; marker reads are capped at 128 bytes. Full quota produces an explicit error instead of unbounded cleanup. Version GC still scans the relay base directory, but remote filtering caps stdout and local candidate work at 64. Cancellation adds one bounded five-second join of channel and transfer settlement."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Run live first-install cancellation and retry on Windows OpenSSH and a split-SFTP Synology-class host.",
        "Keep exact lock-order, no-follow identity, promotion, bounded reclamation, and teardown assertions in the gate command."
      ],
      "knownGaps": [
        "Audit2087 historical pre-removal SFTP gate account; archived verbatim below, not active validation of the reduced sources. Fresh execution of the reduced selector is required before restoring protection.\ncommands:\n[\n        \"node config/scripts/runtime-verification/desktop-transport/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts\"\n      ]\ntestFiles:\n[\n        \"src/main/ssh/sftp-upload.test.ts\",\n        \"src/main/ssh/ssh-file-transfer-abort.test.ts\",\n        \"src/main/ssh/connection/ssh-connection-sftp-wire.test.ts\",\n        \"src/main/ssh/ssh-remote-commands.test.ts\"\n      ]\nassertionRefs:\n[\n        {\n          \"file\": \"src/main/ssh/sftp-upload.test.ts\",\n          \"assertions\": [\"joins local file-descriptor teardown when a live upload is aborted\"]\n        },\n        {\n          \"file\": \"src/main/ssh/ssh-file-transfer-abort.test.ts\",\n          \"assertions\": [\n            \"joins confirmed SFTP close and transfer teardown before rejecting an abort\",\n            \"marks transfer teardown unconfirmed when close wins but the transfer never settles\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/ssh-remote-commands.test.ts\",\n          \"assertions\": [\n            \"uses encoded PowerShell for Windows deploy commands\",\n            \"enumerates Windows staging children before copying\",\n            \"lets only one PowerShell caller acquire a legacy-visible lock\",\n            \"keeps current and legacy fresh locks fenced while one concurrent caller replaces a previous-boot lock\"\n          ]\n        }\n      ]\nevidenceRuns:\n[\n        {\n          \"date\": \"2026-07-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts\",\n          \"currentCommand\": \"node config/scripts/runtime-verification/desktop-transport/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/connection/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 57.9,\n          \"summary\": \"Eleven focused files passed 152 tests with 3 platform skips using exact POSIX sh, native ARM macOS PowerShell 7.6.4, real ssh2 split-SFTP wire sessions, fixed-slot identity races, bounded recovery, joined cancellation teardown, and cross-version isolation.\"\n        }\n      ]\ncoveredPlatforms:\n[\"macos\", \"linux\"]\ncoveredProviders:\n[\"ssh2\", \"system-ssh\"]",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/ssh/sftp-namespace-resolution.test.ts: keeps the shell path and skips probing when both namespaces agree; redirects to the SFTP namespace when only that side carries our marker; handles a start directory that is not a home directory at all; normalizes a trailing slash on the reported start directory; resolves a nested file path, not just the relay directory; refuses an unrelated same-version directory that lacks our marker; keeps the shell path when the marker is already visible there; never probes the candidate after %s on the shell marker; keeps the shell path when the candidate probe is inconclusive; keeps the shell path and skips LSTAT when %s; rejects %s before issuing any SFTP request; redacts marker tokens from discovery diagnostics; issues no discovery requests when no mapping was supplied; ignores a mapping on a Windows host; conservatively ignores a Windows path when platform metadata is absent; resolves on a POSIX host with a mapping. config/scripts/runtime-verification/desktop-transport/run-ssh-staged-upload-reliability.mjs: ordinary registration cleanup removes only . Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/sftp-namespace-resolution.test.ts, config/scripts/runtime-verification/desktop-transport/run-ssh-staged-upload-reliability.mjs remains historical and is not a passing result for the reduced current command.",
        "The live Docker target is Linux ARM64 with a unified namespace; split-SFTP behavior is covered by real ssh2 wire and deterministic deploy fixtures.",
        "Native PowerShell coverage runs on ARM macOS with POSIX filesystem paths; Windows OpenSSH, Windows PowerShell 5.1, and system-SSH behavior remain command and transfer-contract coverage rather than a live target.",
        "No live VM or WSL reboot is injected during native-dependency installation; deterministic host-native command tests provide the previous-boot, current-boot, legacy-marker, and concurrent-takeover oracle.",
        "The fixed pool retains up to eight relay bundles; eight foreign or otherwise unclaimable fixed states require manual inspection instead of automatic deletion.",
        "Version GC remotely filters and caps output but still scans the base .orca-remote directory; it does not promise constant remote enumeration time.",
        "The Docker oracle is opt-in because it requires a local image and a reachable non-loopback host address."
      ],
      "demotionRule": "Demote or quarantine if cancellation creates the shared install lock before transfer settlement, a split-SFTP transfer loses identity proof, recovery deletes a replacement/symlink/reparse/foreign stage, fixed-path work exceeds its eight-slot bound, cancellation leaks a local descriptor, or the focused gate flakes without a product or harness bug."
    },
    {
      "id": "mobile-ui.drawer-close-continuity",
      "title": "Mobile drawers finish closing despite parent rerenders",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "mobile-ui",
      "layer": "react-native-modal-lifecycle",
      "surfaces": [
        "host action sheet",
        "host rename navigation",
        "host removal confirmation",
        "shared mobile bottom drawers"
      ],
      "platforms": ["ios", "android", "macos"],
      "providers": ["provider-independent"],
      "coveredPlatforms": ["ios", "macos"],
      "coveredProviders": ["provider-independent"],
      "coverageNotes": "A deterministic React lifecycle test proves callback churn cannot restart an in-flight drawer close, and an iOS 26.5 simulator run covers Edit Host plus confirmed host removal. Android native-modal behavior remains a live-test gap.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/8791"],
      "invariant": "Once a bottom drawer begins closing, unrelated parent rerenders must not replace its completion callback or restart the native hide animation. The drawer must unmount once and deliver the latest after-close action exactly once.",
      "oracle": "Render one drawer, begin closing it, rerender with new parent callbacks before completion, and require every MountedBottomDrawer frame to retain one onHidden identity. Trigger that completion barrier repeatedly, then require the drawer's null render to commit before only the latest after-close callback runs exactly once.",
      "commands": [
        "pnpm --dir mobile exec vitest run --root .. mobile/src/components/bottom-drawer/bottom-drawer-close-lifecycle.test.ts",
        "Manual iOS 26.5 simulator: long-press paired host; open Edit host; return; long-press host; Remove; confirm Remove; assert host disappears"
      ],
      "testFiles": ["mobile/src/components/bottom-drawer/bottom-drawer-close-lifecycle.test.ts"],
      "assertionRefs": [
        {
          "file": "mobile/src/components/bottom-drawer/bottom-drawer-close-lifecycle.test.ts",
          "assertions": ["keeps close stable and delivers the latest action once after unmount"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-28",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm --dir mobile exec vitest run --root .. mobile/src/components/bottom-drawer-close-lifecycle.test.ts",
          "currentCommand": "pnpm --dir mobile exec vitest run --root .. mobile/src/components/bottom-drawer/bottom-drawer-close-lifecycle.test.ts",
          "result": "passed",
          "durationSeconds": 0.18,
          "summary": "The focused lifecycle harness passed with stable completion identity, latest-callback delivery, and drawer unmount assertions."
        },
        {
          "date": "2026-07-28",
          "runner": "manual",
          "platform": "ios",
          "command": "Manual iOS 26.5 simulator: long-press paired host; open Edit host; return; long-press host; Remove; confirm Remove; assert host disappears",
          "result": "passed",
          "durationSeconds": 37,
          "summary": "Edit host opened responsively after the drawer closed; returning and confirming Remove deleted the host without freezing."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "focused React lifecycle contract test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "One deterministic local contract run and one iOS simulator flow exist; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "On current main, the harness failed because each parent render created a different onHidden callback. The stable completion callback fix passes the byte-identical oracle; restoring the inline callback reproduces the failure."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Any number of parent rerenders retains one close-completion identity, so they add zero hide-animation restarts, timers, listeners, or after-close deliveries."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Run the host Edit and Remove flows on a physical iOS device and an Android emulator or device.",
        "Keep the callback-identity and exactly-once delivery assertions intact for every shared drawer lifecycle change."
      ],
      "knownGaps": [
        "Android native-modal behavior has no live evidence.",
        "The simulator run used an unreachable stored host rather than a connected multi-worktree host.",
        "The contract test injects the hide-completion barrier instead of running Reanimated."
      ],
      "demotionRule": "Keep experimental or demote if parent rerenders can restart drawer hiding, after-close delivery duplicates or goes stale, the focused contract flakes, or either mobile platform retains a touch-blocking modal."
    },
    {
      "id": "mobile-relay.endpoint-recovery",
      "title": "Mobile relay recovery retries offline hosts and races direct endpoints",
      "maturity": "experimental",
      "protection": "none",
      "owner": "mobile-runtime",
      "layer": "shared-mobile-transport-contract",
      "surfaces": [
        "paired mobile reconnect",
        "cloud relay host-offline recovery",
        "LAN direct endpoint",
        "Tailscale direct endpoint"
      ],
      "platforms": ["ios", "android", "macos", "linux", "windows"],
      "providers": ["lan", "tailscale", "cloud-relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Deterministic TypeScript tests cover foreground retry timers, continuous-outage escalation, persistent pairing-rejection escalation, a bounded background Relay grace, direct-winner and background cancellation, credential-gated Relay presentation, and concurrent LAN/Tailscale authentication. Physical iOS/Android radios, GFE, and production relay recovery remain live-test gaps. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/transport/connection-health.test.ts. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the fake-logical-session background lifecycle suite and two supervisor-nudge examples whose fake migration or negative spy supplied the oracle. Its quick-background/grace-expiry/recovery/lease-rotation examples are intentionally lost. The retained nudge callbacks still check healthy-session retention and losing physical-candidate closure; they do not replace the retired lifecycle alarms. Narrowed commands need fresh validation; no physical radio, production Relay or deployed mixed-version claim. Audit1341 scope1334 removes/narrows mobile/src/transport/mobile-relay-reconnect-controller.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/transport/stable-logical-rpc-client.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1735 (refreshed audit1727 at 6da544b7) removes 19 of 38 supervisor definitions. The four retired supervisor assertionRefs covered HOST_OFFLINE self-retry, absent/expired-credential Relay presentation, stale presentation after backgrounded credential selection, and pending presentation through failed-dial cooldown. Those exact alarms are intentionally lost; retained orchestration tests are not equivalent replacement coverage. FakeLogicalClient supplies migration/authentication acceptance and old-session closure, so retained supervisor cases prove timer, async-arbitration and credential-admission coordination only. Narrowed commands require fresh validation; no physical phone, deployed Relay or mixed-version evidence is added. Audit1753 removes the isolated close-code membership and recovery-recipe inventory. Those helper alarms are intentionally lost; retained transport scenarios are not equivalent replacements. No new runtime, physical-device or deployed mixed-version evidence is claimed. Audit1753: the retained nine-file mobile transport command passed90 Node unit cases on Linux. This is one local execution with fake clocks/transports; no live-provider, native-phone, mixed-version, p95 or soak evidence. The original macOS helper receipt is archived in knownGaps; current coveredPlatforms/providers reflect only the new unit receipt.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca-cloud/pull/96",
        "https://linear.app/stably/issue/STA-4587",
        "https://linear.app/stably/issue/STA-4681"
      ],
      "invariant": "A foregrounded paired phone must recover from relay HOST_OFFLINE without a foreground or network-change signal, while direct recovery must select the first authenticated configured LAN or Tailscale endpoint without serial timeout delays. Relay recovery presentation starts only for a failed active Relay or a dial backed by an eligible credential, remains pending through a genuine failed-dial cooldown, and exposes the supervisor's consecutive failed-dial count so a continuous outage escalates to unreachable. A relay credential the desktop keeps refusing escalates to re-pair once its transient-rejection budget is spent, and only an authenticated session clears that verdict. A healthy Relay survives backgrounding for at most 30 seconds and is reused on a quick foreground without redial; expiry, transport failure, direct success, or stop cancels the grace safely, late confirmation bookkeeping preserves lease rotation for a retained live Relay, and losing probes or replacements close without affecting the winner.",
      "oracle": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Historical oracle specification; the retired supervisor examples named in audit1735 knownGaps are no longer current protection. Inject deterministic relay close codes, missing and expired credentials, delayed credential reads, random bytes, fake timers, suspended timers, stale callbacks, and independently controlled direct clients. Require HOST_OFFLINE to replace any faster transport timer with one 5-15 second retry, require no retry before the selected delay, keep Relay presentation absent when no socket can open, clear it across lifecycle races, retain it through real dial cooldowns, retain one healthy Relay through 29,999 milliseconds of background time without a new dial, close it exactly once at 30 seconds or on a later foreground when the timer was suspended, reject a stale expiry after foreground, recover a retained Relay transport failure only after foreground, resume a lease rotation that came due during the grace, arm a lease whose confirmation persistence finishes during the grace, and leave healthy direct sessions unchanged. Establish Relay through the supervisor and require its active close plus 11 failed replacements to publish reconnect attempt 12 and a Relay-unreachable verdict, race all unique non-relay endpoints, select the first authenticated path, close every loser exactly once, and retain no retry after direct connectivity wins. Drive a supervisor-established Relay through four simulated hours of E2EE rejections and require the re-pair verdict, require it to survive a background/foreground cycle, require two rejections followed by acceptance to never latch it, and require a plain transport outage to still read Relay-unreachable.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "focused shared and mobile transport unit tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1753: one retained mobile transport command passed locally on Linux (9files/90cases); no current soak history. The prior helper receipt and its historical flake account are archived in knownGaps."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): On 2026-08-26, the unchanged immediate-teardown implementation failed the new supervisor oracle at the first 29,999-millisecond assertion because suspendActiveSession had already run once; the candidate retained Relay until the exact deadline and rejected stale or OS-suspended timer paths. The first grace candidate also failed the persistence-straddles-background oracle because only one Relay open occurred after the lease rotation deadline; scheduling from retained Relay liveness restores the required second open. Banking the pairing rejection after registerFailure's gated early return — the pre-fix placement — leaves the four-hour E2EE oracle on 'Connecting via Relay…' and reds 7 assertions while the 17 others stay green; moving it ahead of the gate turns them green. The pre-fix production-lifecycle oracle establishes Relay through the supervisor, then completes one active close plus 11 replacement failures while the public retry count remains 0; the candidate publishes 12 and reaches the existing Relay-unreachable verdict. The prior external-signal HOST_OFFLINE policy and serial direct probe also fail their respective retry and first-authenticated-endpoint timing oracles."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): The background grace adds at most one one-shot timer and retains at most the already-active Relay splice for 30 seconds; it adds no polling, new dial, probe, listener, or wire API. A quick foreground performs zero Relay opens, while expiry closes once and opens no replacement until foreground. The deterministic outage asserts exactly one successful establishment plus 11 failed replacements at the escalation boundary. All configured direct candidates start in one turn, the first authenticated candidate wins after 100 ms, and every losing client is closed."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Run paired iOS and Android recovery through production-like GFE HOST_OFFLINE responses.",
        "Measure reconnect radio and battery impact for the 5-15 second foreground retry window."
      ],
      "knownGaps": [
        "No physical iOS or Android device was exercised.",
        "The deterministic transport seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL latency.",
        "React Native timer suspension means the client enforces an overdue deadline on foreground but cannot guarantee server-side splice release at exactly 30 seconds while JavaScript is frozen.",
        "Background-to-foreground recovery remains covered by supervisor tests but lacks a physical sleep/wake run.",
        "Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/transport/connection-health.test.ts. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed.",
        "Archived audit1303 retired-suite historical receipt (JSON; original command/currentCommand/results/counts unchanged): {\"date\":\"2026-08-26\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-background-lifecycle.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts\",\"result\":\"passed\",\"durationSeconds\":1.15,\"summary\":\"Eleven focused mobile transport files passed with 135 assertions, including 30-second Relay retention, supervisor-level timer-suspension recovery, mid-grace transport failure, late-persistence lease rotation, manual retry, and direct-path non-regression.\"}",
        "Archived audit1303 retired-suite historical receipt (JSON; original command/currentCommand/results/counts unchanged): {\"date\":\"2026-08-18\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts\",\"result\":\"passed\",\"durationSeconds\":1.25,\"summary\":\"Eight focused mobile transport files passed with 109 assertions, including production-lifecycle outage escalation, persistent pairing-rejection escalation, and logical count publication.\"}",
        "Audit1310 removes the fake-logical-session background lifecycle suite and two supervisor-nudge examples whose fake migration or negative spy supplied the oracle. Its quick-background/grace-expiry/recovery/lease-rotation examples are intentionally lost. The retained nudge callbacks still check healthy-session retention and losing physical-candidate closure; they do not replace the retired lifecycle alarms. Narrowed commands need fresh validation; no physical radio, production Relay or deployed mixed-version claim.",
        "Archived audit1310 historical receipt (original command/currentCommand/result/count/duration unchanged; not evidence for the shortened suite): {\"date\":\"2026-08-26\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-background-lifecycle.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts\",\"result\":\"passed\",\"durationSeconds\":1.15,\"summary\":\"Eleven focused mobile transport files passed with 135 assertions, including 30-second Relay retention, supervisor-level timer-suspension recovery, mid-grace transport failure, late-persistence lease rotation, manual retry, and direct-path non-regression.\"}",
        "Audit1341 scope1334 removes/narrows mobile/src/transport/mobile-relay-reconnect-controller.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1341 scope1335 removes/narrows mobile/src/transport/stable-logical-rpc-client.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Audit1735 (refreshed audit1727 at 6da544b7) removes 19 of 38 supervisor definitions. The four retired supervisor assertionRefs covered HOST_OFFLINE self-retry, absent/expired-credential Relay presentation, stale presentation after backgrounded credential selection, and pending presentation through failed-dial cooldown. Those exact alarms are intentionally lost; retained orchestration tests are not equivalent replacement coverage. FakeLogicalClient supplies migration/authentication acceptance and old-session closure, so retained supervisor cases prove timer, async-arbitration and credential-admission coordination only. Narrowed commands require fresh validation; no physical phone, deployed Relay or mixed-version evidence is added.",
        "Audit1753 retires the standalone close-code/recovery-recipe assertions, including the HOST_OFFLINE fullJitter flag alarm; the original helper receipt is archived below, and no equivalent replacement is claimed.",
        "Audit1753 retired original helper receipt; complete record preserved: {\n  \"date\": \"2026-08-16\",\n  \"runner\": \"local\",\n  \"platform\": \"macos\",\n  \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/mobile-relay-close-codes.test.ts --reporter=dot\",\n  \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/relay/mobile-relay-close-codes.test.ts --reporter=dot\",\n  \"result\": \"passed\",\n  \"durationSeconds\": 0.17,\n  \"summary\": \"The shared close-code contract passed with five assertions.\"\n}",
        "Audit1753 historical scope before retiring the helper receipt: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"lan\",\"tailscale\",\"cloud-relay\"],\"flakeHistory\":{\"status\":\"unknown\",\"evidence\":\"Two deterministic local runs exist; CI and soak history are not yet available.\"}}",
        "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts --maxWorkers=2\"",
        "Audit2003 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-direct-endpoint-probe.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-background-grace.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-reconnect-controller.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-endpoint-supervisor.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-outage-escalation.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/stable-logical-rpc-client.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-runtime-failover.test.ts\"",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-direct-endpoint-probe.test.ts\",\n          \"assertions\": [\n            \"a reachable Tailscale endpoint authenticates without waiting for a stale primary LAN timeout\",\n            \"the stale direct candidate closes while the authenticated winner stays open\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-background-grace.test.ts\",\n          \"assertions\": [\n            \"the grace expires exactly once at 30 seconds\",\n            \"foreground deadline checks enforce expiry when the OS suspended the timer\",\n            \"a stale expiry callback cannot close a foreground connection\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-reconnect-controller.test.ts\",\n          \"assertions\": [\n            \"keeps one retry timer when recovery changes from capacity to host offline\",\n            \"drops a pending relay retry after direct connectivity wins\",\n            \"latches pairing-rejected only after the transient-rejection budget is spent\",\n            \"keeps the pairing-rejected latch across a gate lift and app resume\",\n            \"never latches pairing-rejected while an authenticated relay is still live\",\n            \"clears the pairing-rejected latch once the desktop authenticates the device\",\n            \"clears the pairing-rejected latch when direct connectivity proves the pairing\",\n            \"reprobes slowly after rejected E2EE authentication instead of parking forever\",\n            \"keeps the fresh-credential gate reprobing after each failed gated attempt\",\n            \"resets the gated cadence when the app returns to the foreground\",\n            \"mints the gate pass when arming a no-bundle reprobe under a held gate\",\n            \"does not arm a gate reprobe timer when the supervisor declined retries\",\n            \"does not let an orphaned reprobe timer swallow the next fast backoff\",\n            \"lifts the fresh-credential gate when a durable bundle carries a new version\",\n            \"does not reset backoff merely because a failed attempt took one ceiling\",\n            \"resets backoff after an authenticated relay remains stable\",\n            \"paces the next dial by the director Retry-After instead of the local backoff\",\n            \"nudges a retained relay tolerantly when availability returns\",\n            \"redials an attach timeout once quickly per failure streak\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts\",\n          \"assertions\": [\n            \"a replacement Relay that authenticates after backgrounding withdraws without replacing the retained session\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-outage-escalation.test.ts\",\n          \"assertions\": [\n            \"a supervisor-established Relay close plus 11 failed replacements publish reconnect attempt 12\",\n            \"the existing connection classifier escalates the continuous outage to Can't connect via Relay\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts\",\n          \"assertions\": [\n            \"a persistent E2EE rejection escalates to Pairing invalid — re-pair with your desktop\",\n            \"the re-pair verdict survives a background/foreground cycle\",\n            \"rejections inside the transient budget followed by acceptance never latch it\",\n            \"a plain transport outage still reads Can't connect via Relay\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/stable-logical-rpc-client.test.ts\",\n          \"assertions\": [\n            \"makes before break, rejects in-flight work, and replays subscriptions\",\n            \"keeps replies that commit before cutover and carries viewport state into replay\",\n            \"suspends one physical session and replays subscriptions on foreground replacement\",\n            \"reports requests the suspended session never sent as suspended, and written ones as ambiguous\",\n            \"preserves delivery ambiguity without replaying a mutation after relay replacement\",\n            \"lets the physical close settle in-flight requests on close, keeping pre-write failures definite\",\n            \"preserves a committed response when logical close wins the callback race\",\n            \"publishes the replacement dial phases while the client is suspended\",\n            \"forwards a reconnecting phase published by the dialing session itself\",\n            \"names a relay dial started from reconnecting without disturbing the state\",\n            \"publishes recovery-path changes and keeps Relay pending between failed dials\",\n            \"does not revive a stale recovery path after a connection later drops\",\n            \"drops the pending path when the previous session recovers mid-dial\",\n            \"never downgrades a live session while a make-before-break replacement dials\",\n            \"restores disconnected when a dial it was narrating fails\",\n            \"outlives the flat bound when the relay cell holds the dial\",\n            \"closes a replacement that fails authentication and preserves the active session\",\n            \"drops a stream event that lands after the caller unsubscribed\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-runtime-failover.test.ts\",\n          \"assertions\": [\n            \"a fresh credential starts Relay presentation with the controller's current count\",\n            \"missing or expired credentials never open a Relay socket\"\n          ]\n        }",
        "Audit2003 historical original coveredPlatforms object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"linux\"]",
        "Audit2003 historical original coveredProviders object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[]",
        "Audit2003 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-11-07\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.819,\n          \"summary\": \"9 test files and 90 cases passed in the retained mobile transport command on candidate base35975c05 with audit1754 deletions. Node unit scenarios use fake clocks/transport/native stand-ins; no physical phone, deployed Relay, real LAN/Tailscale, mixed-version peer, p95 or soak evidence. The removed helper inventories have no equivalent replacement claim.\"\n        }"
      ],
      "demotionRule": "Keep experimental or demote if focused tests flake, HOST_OFFLINE can park indefinitely, direct probes serialize configured endpoints, loser cleanup leaks clients, or physical-device radio cost exceeds the measured budget."
    },
    {
      "id": "mobile-transport.lifecycle-liveness",
      "title": "Wanted mobile hosts self-heal without false physical-session death",
      "maturity": "experimental",
      "protection": "none",
      "owner": "mobile-runtime",
      "layer": "mobile-provider-and-physical-session-contract",
      "surfaces": [
        "mobile host acquisition",
        "Keychain and Keystore catalog reads",
        "direct LAN and Tailscale RPC",
        "cloud relay RPC",
        "foreground and network revival"
      ],
      "platforms": ["ios", "android", "macos", "linux", "windows"],
      "providers": ["lan", "tailscale", "cloud-relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Deterministic React/provider tests cover catalog, missing-host, construction, cancellation, release, forget, refresh, backoff, stale-generation outcomes, and path-aware recovery presentation. Direct sessions cover idle probing and three fair misses. Relay sessions cover a 15s idle probe, rate-limited foreground probes, two fair misses, authenticated activity before semantic decoding, delivery ambiguity, scheduler stalls, and write failure. Physical iOS/Android sleep, carrier/Tailscale loss, and production relay paths remain live-test gaps. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/transport/connection-health.test.ts. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1315 removes/narrows mobile/src/transport/rpc-session-liveness-watchdog.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1322 removes/narrows mobile/src/transport/rpc-session-liveness-integration.test.ts, mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/transport/mobile-relay-rpc-session.test.ts, mobile/src/transport/stable-logical-rpc-client.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1351 refreshes Audit1339 removals/narrowing of mobile/src/transport/mobile-relay-e2ee-link.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4153/mobile-app-disconnects-frequently"
      ],
      "invariant": "A provider-wanted host without a logical client retries every current-generation pre-client failure until success or explicit cancellation, while release, disconnect, forget, refresh, and stale async continuations preserve their distinct resurrection policies. Direct sessions probe after authenticated silence and terminate after three fair misses. Relay sessions probe after 15s of authenticated silence, retry at once after a fair miss, probe on demand only decisively while a caller's reply is overdue after 4s of authenticated silence, use rate-limited foreground probes, and terminate after two fair misses; a tolerant miss does not count while authenticated frames arrived during the probe window, or while a sent request still awaits its reply and the link has been silent for less than the request timeout. Authenticated traffic, scheduler stalls, and replacement identities cannot manufacture death. Relay recovery must notify presentation independently of transport-state changes, must not inherit a failed direct path's Tailscale hint, and must retain long-outage escalation.",
      "oracle": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Inject rejected and never-settling catalog reads, missing profiles, synchronous construction failure, release, refresh, forget, revival, and stale completion under fake time. Require bounded 1s through 60s retry, exact current-generation publication, and no zero-owner or forgotten-client resurrection. Inject direct and relay authenticated text/binary traffic, silent probe windows, stalled clocks, replacement identities, and failed writes. Require direct three-miss tolerance; Relay idle probes only after 15s without authenticated frames, no demand-driven liveness traffic, one foreground probe sequence, two fair 4s misses, a 10s voluntary rate limit, no old-session network-change probe, and delivery-unknown mutations without replay. Start and clear Relay recovery without changing transport state and require observers to rerender. Project five failed Tailscale attempts into a neutral Relay-specific verdict, then require twelve attempts to produce a Relay-specific unreachable verdict with no Tailscale hint. Upstream oracle specification after Relay correction (not execution evidence): Inject rejected and never-settling catalog reads, missing profiles, synchronous construction failure, release, refresh, forget, revival, and stale completion under fake time. Require bounded 1s through 60s retry, exact current-generation publication, and no zero-owner or forgotten-client resurrection. Inject direct and relay authenticated text/binary traffic, silent probe windows, stalled clocks, replacement identities, and failed writes. Require direct three-miss tolerance; Relay idle probes only after 15s without authenticated frames, one foreground probe sequence, two fair 4s misses, a 10s voluntary rate limit, no old-session network-change probe, and delivery-unknown mutations without replay. Start and clear Relay recovery without changing transport state and require observers to rerender. Project five failed Tailscale attempts into a neutral Relay-specific verdict, then require twelve attempts to produce a Relay-specific unreachable verdict with no Tailscale hint.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "focused mobile provider and transport unit tests New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): One deterministic local focused run exists; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Current main failed six deterministic assertions: terminal catalog failure, zero-owner publication, stale failure clobber, initial direct handshake write throw, one-window direct death, and foreground probe write throw. The candidate passes the same assertions and adds relay parity, backoff, cancellation, and scheduler-fairness coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Each wanted clientless host owns at most one open and one retry timer with a 60-second capped tail. Direct sessions own one idle or probe timer. Relay sessions own one idle or probe timer and send at most one idle probe per 15 seconds without authenticated frames, about four small round trips per idle foreground minute, and no demand-driven liveness traffic; foreground sequences start at most once per 10 seconds. Each Relay idle probe costs one relay forward and one desktop status.get probe dispatch; no subprocess or wire opcode is introduced. Upstream resource specification after Relay correction (not a measured budget): Each wanted clientless host owns at most one open and one retry timer with a 60-second capped tail. Direct sessions own one idle or probe timer. Relay sessions own one idle or probe timer and start an idle probe 15 seconds after the last authenticated frame, about four small round trips per healthy idle foreground minute. A fair miss on a link that isn't busy sends one retry as soon as its 4-second timeout fires, and a second fair miss closes the session. Demand-driven probes are decisive and run only while a caller's reply is overdue after 4 seconds of authenticated silence, at most one per 4 seconds; foreground sequences start at most once per 10 seconds. Each Relay probe costs one relay forward and one desktop status.get probe dispatch; no subprocess or wire opcode is introduced."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Capture the existing final-timeout log immediately before an affected-device drop.",
        "Run physical iOS and Android direct LAN, Tailscale, relay, background/resume, and network-handoff journeys.",
        "Measure reconnect radio and battery impact during the 60-second catalog retry tail, direct 44-second idle liveness budget, Relay 15-second idle probes, and Relay foreground probes."
      ],
      "knownGaps": [
        "No physical iOS or Android device was exercised.",
        "No affected-device log yet proves the old one-window watchdog caused the reported live-session drop.",
        "Carrier NAT, production Tailscale, production relay cells, and real scheduler suspension remain unmeasured.",
        "Persistent pre-client failure metadata is not yet exposed in Home UI.",
        "Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/transport/connection-health.test.ts. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed.",
        "Archived audit1303 retired-suite historical receipt (JSON; original command/currentCommand/results/counts unchanged): {\"date\":\"2026-08-16\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/connection-health.test.ts\",\"result\":\"passed\",\"durationSeconds\":0.77,\"summary\":\"Eleven focused files passed 85 deterministic provider lifecycle, path presentation, direct/Relay liveness, traffic, and delivery-ambiguity tests.\"}",
        "Audit1315 removes/narrows mobile/src/transport/rpc-session-liveness-watchdog.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Archived audit1315 historical receipt (original command/currentCommand/result/count/duration unchanged; not evidence for the shortened suite): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1311-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":3.65,\"summary\":\"Test Files  10 passed (10); Tests  125 passed (125). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head 36536504876bf7fa79c79256377cde97f1f3a133.\"}",
        "Retired during audit1319 current-main refresh; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1319-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":3.1,\"summary\":\"Test Files  10 passed (10); Tests  114 passed (114). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"}",
        "Audit1322 removes/narrows mobile/src/transport/rpc-session-liveness-integration.test.ts, mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Retired during audit1324 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1319-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":2.98,\"summary\":\"Test Files  10 passed (10); Tests  114 passed (114). Focused current Linux unit run; Windows-specific execution remains platform-gated. Single execution, no p95, physical-provider or cross-platform measurement. Source head f6290fb9d8c471dfb79a838d86eb6398582744f4.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1324-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":2.87,\"summary\":\"Test Files  10 passed (10); Tests  90 passed (90). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 49e2978f83d521bd487e52e0b8b21a1902834caf.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1324-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":2.87,\"summary\":\"Test Files  10 passed (10); Tests  90 passed (90). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 4fa83106fcdb5ffd53ad527bf59f83b72aec2285.\"}",
        "Audit1341 scope1335 removes/narrows mobile/src/transport/mobile-relay-rpc-session.test.ts, mobile/src/transport/stable-logical-rpc-client.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Archived audit1341 scope1335 historical receipt (original command/currentCommand/result/count/duration unchanged; not evidence for the shortened suite): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1324-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":2.91,\"summary\":\"Test Files  10 passed (10); Tests  90 passed (90). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"}",
        "Audit1351 refreshes Audit1339 removals/narrowing of mobile/src/transport/mobile-relay-e2ee-link.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Retired during audit1352 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1345-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\"durationSeconds\":3.07,\"summary\":\"Test Files  10 passed (10); Tests  83 passed (83). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"}",
        "Audit2003: Remove held-subscription and viewport replay, background suspension, delivery-ambiguity/error propagation, dial-phase/recovery-path projections, relay timing and authentication-failure examples from the logical client. Retain only make-before-break cutover with subscription replay, committed-response/close arbitration and late-event cancellation fencing against fake physical sessions. Retire all dated combined receipts whole; their case counts and sibling results do not validate these changed bytes. Archive all prospective selector/file/assertion and covered-scope fields with the downgraded gate; the three retained logical callbacks are described here only, without active gate authority. Downgrade active protection to none because no independent unchanged receipt survives. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/client-context.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/host-open-recovery.test.tsx\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/host-open-retry-scheduler.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/rpc-session-liveness-watchdog.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/rpc-session-liveness-integration.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-rpc-session.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-endpoint-nudge-router.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/mobile-relay-e2ee-link.test.ts\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"mobile/src/transport/stable-logical-rpc-client.test.ts\"",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/client-context.test.ts\",\n          \"assertions\": [\n            \"a retired close-on-release owner closes an ownerless manual reconnect\",\n            \"a Relay recovery path change rerenders observers without a transport-state change\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/host-open-recovery.test.tsx\",\n          \"assertions\": [\n            \"catalog, missing-host, and construction failures retry without remounting\",\n            \"final release and forget prevent later client publication\",\n            \"refresh bypasses a never-settling stale open and stale failure cannot clobber its replacement\",\n            \"revival expedites recovery without resetting the failure tier\",\n            \"a retired owner's release cannot cancel a newer owner's open\",\n            \"explicit reconnect demand survives a pre-client failure\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/rpc-session-liveness-watchdog.test.ts\",\n          \"assertions\": [\n            \"does not reuse a probe id after the same identity starts a new generation\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/rpc-session-liveness-integration.test.ts\",\n          \"assertions\": [\n            \"upgrades a focus probe on resume without letting repeated nudges extend the deadline\",\n            \"reconnects when control probes stall while terminal and browser traffic continues\",\n            \"ignores superseded probes and unrelated RPC replies during a control check\",\n            \"does not let probe replies consume the authentication retry budget\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-rpc-session.test.ts\",\n          \"assertions\": [\n            \"releases stream listeners on failure even when close follows it\",\n            \"connects when an older runtime rejects capability negotiation\",\n            \"connects when the relay never answers capability negotiation\",\n            \"rejects a mismatched outer credential version and closes the physical link\",\n            \"routes terminal and browser binary streams after confirmation\",\n            \"keeps the configured connect default for omitted options and honors explicit timeouts\",\n            \"rejects pending RPC work when the physical link fails\",\n            \"releases requests waiting on a failed session once it is retired, unsent\",\n            \"keeps a synchronous pre-write relay failure definite\",\n            \"marks in-flight requests delivery-unknown when the session closes\",\n            \"marks a relay RPC timeout delivery-unknown\",\n            \"sends a server workspace call as the same top-level executionHost frame as before the envelope\",\n            \"merges an envelope under the transport fields on requests, subscribes and unsubscribes\",\n            \"carries captured GitHub authority through the production relay physical await without replay\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts\",\n          \"assertions\": [\n            \"keeps availability returns tolerant while a proven resume bypasses recent probes\",\n            \"probes an idle relay and closes it when the probes go unanswered\",\n            \"keeps an idle relay open while a slow reply is still downloading\",\n            \"closes a silent relay even while requests keep going unanswered\",\n            \"keeps an idle relay open while a stream backlog delays the probe reply\"\n          ]\n        }",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"mobile/src/transport/stable-logical-rpc-client.test.ts\",\n          \"assertions\": [\n            \"makes before break, rejects in-flight work, and replays subscriptions\",\n            \"keeps replies that commit before cutover and carries viewport state into replay\",\n            \"suspends one physical session and replays subscriptions on foreground replacement\",\n            \"reports requests the suspended session never sent as suspended, and written ones as ambiguous\",\n            \"preserves delivery ambiguity without replaying a mutation after relay replacement\",\n            \"lets the physical close settle in-flight requests on close, keeping pre-write failures definite\",\n            \"preserves a committed response when logical close wins the callback race\",\n            \"publishes the replacement dial phases while the client is suspended\",\n            \"forwards a reconnecting phase published by the dialing session itself\",\n            \"names a relay dial started from reconnecting without disturbing the state\",\n            \"publishes recovery-path changes and keeps Relay pending between failed dials\",\n            \"does not revive a stale recovery path after a connection later drops\",\n            \"drops the pending path when the previous session recovers mid-dial\",\n            \"never downgrades a live session while a make-before-break replacement dials\",\n            \"restores disconnected when a dial it was narrating fails\",\n            \"outlives the flat bound when the relay cell holds the dial\",\n            \"closes a replacement that fails authentication and preserves the active session\",\n            \"drops a stream event that lands after the caller unsubscribed\"\n          ]\n        }",
        "Audit2003 historical original coveredPlatforms object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"macos\", \"linux\"]",
        "Audit2003 historical original coveredProviders object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"lan\", \"tailscale\", \"cloud-relay\"]",
        "Audit2003 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1352-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\n          \"durationSeconds\": 2.65,\n          \"summary\": \"Test Files  10 passed (10); Tests  80 passed (80). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit2003 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"cd mobile && ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1360-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config vitest.config.ts src/transport/client-context.test.ts src/transport/host-open-recovery.test.tsx src/transport/host-open-retry-scheduler.test.ts src/transport/mobile-endpoint-nudge-router.test.ts src/transport/mobile-relay-e2ee-link.test.ts src/transport/mobile-relay-rpc-session-liveness.test.ts src/transport/mobile-relay-rpc-session.test.ts src/transport/rpc-session-liveness-integration.test.ts src/transport/rpc-session-liveness-watchdog.test.ts src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts\",\n          \"durationSeconds\": 2.67,\n          \"summary\": \"Test Files  10 passed (10); Tests  80 passed (80). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "No test in the commands covers the decisive on-demand Relay probe that runs while a dictation reply is overdue (rpc-liveness-probe-while-waiting.ts)."
      ],
      "demotionRule": "Keep experimental or demote if a wanted host can park without retry, stale work can publish or notify, disconnect or forget resurrects a host, direct closes before three fair misses, Relay idle-probes within 15s of authenticated traffic, probes on demand while replies arrive on time, survives two fair misses, authenticated traffic fails to restore health, timers leak across identity replacement, mutations replay after ambiguous delivery, or physical-device radio cost exceeds the measured budget."
    },
    {
      "id": "desktop-relay.assignment-backpressure",
      "title": "Desktop relay drain recovery cannot amplify a director outage",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "desktop-runtime",
      "layer": "main-relay-state-machine",
      "surfaces": [
        "desktop relay drain recovery",
        "director assignment overload",
        "relay broker shutdown"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["cloud-relay"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["cloud-relay"],
      "coverageNotes": "Deterministic main-process tests cover duplicate drain notifications, full-jitter backoff, Retry-After during initial setup and drain recovery, successful recovery, and broker-close cleanup. Packaged desktop, mixed-version fleets, GFE, and production Cloud SQL remain live-test gaps.",
      "motivatingLinks": ["https://github.com/stablyai/orca-cloud/actions/runs/30223521062"],
      "invariant": "One relay host may have at most one assignment attempt or retry timer per recovery path. Sustained director failure must increase the retry window up to five minutes, a bounded Retry-After must be respected during initial setup and drain recovery, shutdown must cancel pending work, and recovery must activate the authoritative assigned origin.",
      "oracle": "Inject duplicate drain events, deterministic randomness, fake time, repeated assignment failures, a 30-second Retry-After during initial setup and drain recovery, broker close, and eventual director recovery. Count every assignment call, require 500 ms then 1,000 ms retry windows, reject duplicate fanout, require no pre-hint retry or post-close work, and prove the recovered cell becomes authoritative.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot"
      ],
      "testFiles": [
        "src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts",
        "src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts",
        "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts",
          "assertions": [
            "duplicate drain notifications share one exponentially backed-off retry schedule",
            "Retry-After suppresses early assignment requests",
            "broker close prevents retry resurrection",
            "a later successful assignment activates the new origin"
          ]
        },
        {
          "file": "src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts",
          "assertions": ["assignment overload preserves a bounded Retry-After hint"]
        },
        {
          "file": "src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts",
          "assertions": ["initial relay setup does not retry before Retry-After expires"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-26",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-cloud-relay/relay-session-broker.test.ts src/main/runtime/mobile-cloud-relay/relay-http-client.test.ts src/main/runtime/mobile-cloud-relay/relay-auth-coordinator-recovery.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 0.49,
          "summary": "Three focused relay files passed with 25 assertions."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 5,
        "scope": "focused desktop relay state-machine tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "One deterministic local run exists; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The prior fixed-delay implementation issued a duplicate assignment within 499 ms and ignored Retry-After, while the candidate passes the byte-identical timer and call-count oracle."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "One host retains at most one assignment attempt or retry timer, retry windows grow to a five-minute cap, duplicate drain events add no calls, and close leaves no timer-driven work."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Run a mixed-version load test with at least the incident-scale desktop population.",
        "Verify production director request rate decays during an injected assignment outage."
      ],
      "knownGaps": [
        "No packaged desktop or physical phone was exercised.",
        "The deterministic seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL behavior.",
        "Legacy desktop versions remain dependent on server-side overload protection."
      ],
      "demotionRule": "Keep experimental or demote if assignment calls overlap, duplicate drain events bypass backoff, Retry-After is ignored, close resurrects work, or mixed-version request rate exceeds the reviewed director budget."
    },
    {
      "id": "desktop-relay.region-correction-idle-cutover",
      "title": "Regional correction moves only an idle relay source",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "desktop-runtime",
      "layer": "cell-desktop-real-websocket",
      "surfaces": ["regional correction", "idle source cutover", "desktop relay reconnect"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["cloud-relay"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["cloud-relay"],
      "coverageNotes": "Real local WebSocket/control/proof/splice traffic and production SQLite store run with synthetic clock and synthetic token verification. Separate PostgreSQL16 suites validate SQL concurrency. This does not measure production network latency, physical phones, UI, or the production token issuer.",
      "motivatingLinks": [
        "docs/relay-region-correction/RELAY-REGION-CORRECTION-IDLE-CUTOVER-PLAN.md"
      ],
      "invariant": "Regional optimization never closes an established relay client. The source gates admissions only after actual work is idle, commits the exact assignment atomically, and releases its empty control. A failed target uses ordinary migration recovery; previously sent mutations are not replayed.",
      "oracle": "Two real TCP WebSocket cells, the actual desktop origin pool, SQLite and an independent execution child verify busy phone/iPad deferral, idle movement, racing arrival rejection, definite-abort admission recovery and observed target-registration failure with ordinary rollback.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/relay-region-correction.unit.test.ts"
      ],
      "testFiles": ["tests/e2e/relay-region-correction.unit.test.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/relay-region-correction.unit.test.ts",
          "assertions": [
            "releases the empty source and recovers normally when the target never registers",
            "rejects an arrival during cutover and restores admissions after a definite failed commit",
            "defers for either connected device, then moves after both disconnect without replaying work"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-11",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test tests/e2e/relay-region-correction.unit.test.ts",
          "result": "passed",
          "durationSeconds": 6.44,
          "summary": "Three real TCP WebSocket cases passed after removing store retention. Log: .tmp/idle-cutover-review/transport-without-retention.log. Does not validate packaged or physical clients."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "three local real-WebSocket scenarios with synthetic elapsed time for ordinary recovery"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Local implementation validation; no CI soak history yet."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Registry admission accounting negative control and five conflicting operation-identity regressions fail before their fixes and pass afterward. Locked database reconciliation has separate red/green evidence. Full cross-layer counterfactual remains unverified."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No retained source lease or new mobile timer. Candidate selection is read-only; busy sources immediately defer. Idle cutover reuses normal desktop reconnect and existing migration recovery."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak.",
        "Complete mixed-version and packaged-client validation.",
        "Validate bounded rollout latency and reliability against reviewed numerical limits."
      ],
      "knownGaps": [
        "Production authentication verifier is mocked.",
        "Synthetic elapsed time is not a wall-clock soak.",
        "Physical phone lifecycle, packaged mixed versions, SSH execution and production network behavior require separate validation."
      ],
      "demotionRule": "Keep experimental or demote if optimization closes an established client, a gate reopens on ambiguous authority, a mutation is replayed, cleanup is lost, or eligible idle hosts starve."
    },
    {
      "id": "git-worktree.refresh-event-semantics",
      "title": "Index-only Git metadata cannot trigger structural worktree refresh fanout",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "main-preload-renderer-contract",
      "surfaces": [
        "terminal input availability",
        "worktree discovery",
        "Source Control status refresh",
        "direct SSH generation-scope rollover"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Module layout SSH policy: Retire reset/private-arithmetic generation rollover registrations. The two retained local-versus-SSH mutation refusals do not establish process-scope rollover or sibling-token invalidation; remove this unrelated gate selector and its rollover assertion claim. Unchanged unrelated execution receipts retain only their original scope. No replacement, fresh rollover execution or cross-platform proof is claimed. Historical prior account (preserved verbatim): Audit2003: Remove the standalone one-client shared-runtime/headless-publication example. The retained two-client callback (real WebSocket/runtime coordination with supplied Git listings and watcher notifications) and invalidated scan/reconnect races keep their exact owning scope, without replacement-equivalence or rendered-headless proof. Retire the entire dated38-case receipt through its effective currentCommand. Preserve the unrelated SSH bridge receipt and paired Electron receipt within their original commands. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, paired-runtime publication to two independent clients with reconnect and stale-cache checks, and process generation-scope rollover across sibling targets. A headed macOS Electron host and separate paired Electron client both rendered a worktree created through the real Git binary and watcher entry path without reconnect. Linux/Windows desktop clients, multi-target live fanout, and WSL runs remain gaps. Audit1309: src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts: Keep real filesystem HEAD/loose/packed/relative metadata reads and traversal refusal. Remove invalid-oid/nonstandard-layout characterization. Lose malformed object-id and bare-dir omission alarms; no Git-produced layout claim. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1381 removes the two mock-forwarding registrations in src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts. Sibling attribution suppression and missing/unknown attribution refresh callback alarms are intentionally lost; no equivalent replacement or real hook lifecycle/status-update coverage is claimed. Remaining exact receipts, platform/provider scope, and budgets remain limited to their unchanged selectors; no new execution result is claimed. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7086",
        "https://github.com/stablyai/orca/issues/16477"
      ],
      "invariant": "Index-only Git activity below the common Git directory must not emit worktrees:changed, invalidate worktree caches, or trigger fetchWorktrees fanout; structural add/remove/HEAD/gitdir/locked/config.worktree changes must still refresh worktrees and nudge Source Control. When the authoritative paired host accepts an external structural change for a uniquely identified server-local repo, each live client for that host must receive one existing host-scoped worktreesChanged invalidation and converge to the same repo/worktree identity without reconnect; duplicate watcher events must coalesce, stale cached or in-flight catalogs must not survive invalidation, and event-ignoring clients must remain compatible. Colliding local/SSH repo IDs must not publish the host-blind event until existing semantics can carry owner identity. External head moves (commit, amend, reset) must reach background worktree rows through spawn-free metadata reads, never through structural fanout. A process generation-scope rollover revokes every direct SSH target and old-scope provider request, not only the target whose counter exhausted.",
      "oracle": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Module layout SSH policy: Retire reset/private-arithmetic generation rollover registrations. The two retained local-versus-SSH mutation refusals do not establish process-scope rollover or sibling-token invalidation; remove this unrelated gate selector and its rollover assertion claim. Unchanged unrelated execution receipts retain only their original scope. No replacement, fresh rollover execution or cross-platform proof is claimed. Historical prior account (preserved verbatim): Audit2003: Remove the standalone one-client shared-runtime/headless-publication example. The retained two-client callback (real WebSocket/runtime coordination with supplied Git listings and watcher notifications) and invalidated scan/reconnect races keep their exact owning scope, without replacement-equivalence or rendered-headless proof. Retire the entire dated38-case receipt through its effective currentCommand. Preserve the unrelated SSH bridge receipt and paired Electron receipt within their original commands. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Classify exact git-common paths as structural, status-only, or ignored; count notifications from debounced watcher events; force the Linux/Windows poll path to emit allowlisted leaf events, detect linked HEAD rewrites independent of entry-directory mtime, and surface in-place index rewrites via the backstop re-stat; diff head identities from metadata-file reads and notify only real head moves. Join the real runtime RPC server to two independently authenticated E2EE clients plus an event-ignoring client, advance the host Git inventory, trigger duplicate structural watcher callbacks, and require one host renderer notification plus one runtime event and a refreshed catalog per subscribed client; require the event-ignoring client to refresh safely on explicit read. Hold a scan after it captures old inventory, join it from a second paired client, publish the watcher invalidation, advance Git independently, and require both overlapping RPCs to retry or join one fresh scan before returning. Disconnect one client, advance inventory again, and require reconnect to read current state without stale event replay. Give a watcher a local repo ID colliding with an SSH owner and require the host renderer refresh while the unqualified runtime event stays absent. Force the real path in isolated Electron apps with git worktree add, a host Git inventory assertion, store-subscription barriers, matching host/client worktree identity, and visible rows in both renderers. For direct SSH, roll one exhausted target into a fresh process generation scope while invalidating sibling target tokens, and fill a partial pushed authority before clearing that target's PTY bindings once. Audit1381 removes the two mock-forwarding registrations in src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts. Sibling attribution suppression and missing/unknown attribution refresh callback alarms are intentionally lost; no equivalent replacement or real hook lifecycle/status-update coverage is claimed. Remaining exact receipts, platform/provider scope, and budgets remain limited to their unchanged selectors; no new execution result is claimed.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees/creation/worktree-base-directory-event-filter.test.ts src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts",
        "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot"
      ],
      "testFiles": [
        "src/main/ipc/worktrees/creation/worktree-base-directory-event-filter.test.ts",
        "src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts",
        "src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts",
        "tests/e2e/paired-external-worktree-discovery.spec.ts",
        "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts",
          "assertions": [
            "loose-ref, packed-refs, detached, unborn, and relative-gitdir layouts resolve or skip without spawning Git",
            "traversal-shaped or backslash/colon symrefs are rejected before any path join and only hex object ids are ever emitted"
          ]
        },
        {
          "file": "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
          "assertions": [
            "a filled partial SSH authority clears the target's PTY bindings once and a conflicting reply is rejected"
          ]
        },
        {
          "file": "src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts",
          "assertions": [
            "duplicate host watcher callbacks coalesce to one local notification and one worktreesChanged event for each of two live paired clients",
            "host inventory and both paired catalogs advance to the same worktree identity after runtime cache invalidation",
            "an invalidated in-flight host scan and a second client's joined read converge through one fresh retry before either can return stale data",
            "a disconnected client reconnects to current catalog state without replaying a stale invalidation",
            "an event-ignoring client remains compatible, and colliding local/SSH owners do not publish an owner-blind event"
          ]
        },
        {
          "file": "tests/e2e/paired-external-worktree-discovery.spec.ts",
          "assertions": [
            "a real git worktree add advances the authoritative host inventory",
            "the headed host and separate paired Electron client render the same new worktree identity",
            "the paired client's main-process shared-control transport keeps one connection epoch while converging and compares Windows paths case-insensitively"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-10-11",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 1.21,
          "summary": "The direct SSH state-bridge wiring file passed with 6 tests after the reconnect coordinator, scheduler and telemetry were deleted."
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-external-worktree-discovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 17.96,
          "summary": "One forced-visible paired Electron test passed: real Git inventory, matching visible host/client rows, and one unchanged main-process shared-control transport epoch during convergence."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1412; any retained unchanged-source receipts apply only to their own commands. Historical account: Four focused deterministic local macOS runs cover the original watcher lane, paired-runtime publication lane, main catalog/authority lane, and direct SSH scheduler/telemetry lane; two live Electron runs cover paired external discovery and Docker SSH, while CI soak is still unavailable."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1412 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The watcher count assertions fail against the old single-signal classifier because linked index events call notifyWorktreesChanged. No intentional-break artifact was run or claimed; saved red/green artifacts are still needed before blocking promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Index-only bursts produce zero structural notifications, so renderer fetchWorktrees and detected-worktree cache invalidation are not reached. The non-darwin poller stays bounded and non-overlapping. A 30-second live Electron run with 2,000 external linked-status calls delivered 50 ordered input chunks and recorded zero Orca-owned git worktree spawns across six diagnostic windows."
      },
      "promotionCriteria": [
        "Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach live Electron main-thread diagnostic evidence for repeated linked-worktree index rewrites while typing.",
        "Add Linux/Windows live watcher evidence if shared poller-layer coverage diverges from platform behavior."
      ],
      "knownGaps": [
        "Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The live Electron diagnostic and screenshot evidence must remain attached to the motivating PR for durable review.",
        "Linux and Windows are forced through the shared non-darwin poller in unit tests but are not live-tested here.",
        "Git loose ref watching remains outside this incident fix by design.",
        "SSH watches classify head-move triggers but skip the metadata-read identity diff; remote background-worktree heads still wait on a structural event or activation.",
        "The Docker/Linux journey covers one direct SSH target; a live multi-target fanout and large-catalog benchmark remains missing.",
        "Paired web clients intentionally do not run the desktop direct SSH coordinator, and paired-close non-interference lacks a new live run.",
        "WSL direct SSH fanout remains an explicit live-test gap rather than inferred coverage.",
        "Audit1309: src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts: Keep real filesystem HEAD/loose/packed/relative metadata reads and traversal refusal. Remove invalid-oid/nonstandard-layout characterization. Lose malformed object-id and bare-dir omission alarms; no Git-produced layout claim. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1309 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees/creation/worktree-base-directory-event-filter.test.ts src/main/ipc/worktrees/creation/worktree-base-directory-watcher.test.ts src/main/ipc/worktrees/creation/worktree-base-directory-poller.test.ts src/main/ipc/worktrees/creation/worktree-head-identity-reader.test.ts src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.12,\n          \"summary\": \"7 files and 130 tests passed locally, adding head-identity emit-on-change without structural fanout, reflog status triggers, config.worktree structural classification, the in-place index backstop, and the spawn-free head reader with symref traversal rejection and hex-object-id output validation.\"\n        }",
        "Audit1381 removes the two mock-forwarding registrations in src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts. Sibling attribution suppression and missing/unknown attribution refresh callback alarms are intentionally lost; no equivalent replacement or real hook lifecycle/status-update coverage is claimed. Remaining exact receipts, platform/provider scope, and budgets remain limited to their unchanged selectors; no new execution result is claimed.",
        "Audit1381 historical assertion inventory for removed suite:\n[\n  {\n    \"file\": \"src/renderer/src/components/right-sidebar/source-control/sync/git-status-push-signal-refresh.test.ts\",\n    \"assertions\": [\n      \"Source Control nudges only for the active visible repo on structural and status-only signals\",\n      \"preload subscriptions and terminal command-finished listeners are cleaned up\"\n    ]\n  }\n]",
        "Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed.",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.61,\n          \"summary\": \"Three main-process catalog and authority files passed with 118 tests, including contradictory catalog provenance rejection and all-target generation-scope revocation. The third file, src/main/ipc/repos-remote.test.ts, was later deleted with the SSH repo IPC handlers.\"\n        }",
        "Audit1412 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1412 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/ssh/ssh-provider-authority.test.ts\",\n    \"assertions\": [\n      \"generation-scope rollover invalidates every target authority before abort callbacks run\",\n      \"every registered old-scope provider request aborts exactly once\"\n    ]\n  }\n]",
        "Audit2003: Remove the standalone one-client shared-runtime/headless-publication example. The retained two-client callback (real WebSocket/runtime coordination with supplied Git listings and watcher notifications) and invalidated scan/reconnect races keep their exact owning scope, without replacement-equivalence or rendered-headless proof. Retire the entire dated38-case receipt through its effective currentCommand. Preserve the unrelated SSH bridge receipt and paired Electron receipt within their original commands. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts\",\n          \"assertions\": [\n            \"duplicate host watcher callbacks coalesce to one local notification and one worktreesChanged event for each of two live paired clients\",\n            \"host inventory and both paired catalogs advance to the same worktree identity after runtime cache invalidation\",\n            \"an invalidated in-flight host scan and a second client's joined read converge through one fresh retry before either can return stale data\",\n            \"a disconnected client reconnects to current catalog state without replaying a stale invalidation\",\n            \"an event-ignoring client remains compatible, and colliding local/SSH owners do not publish an owner-blind event\",\n            \"the shared runtime publication remains valid without a headed renderer notifier\"\n          ]\n        }",
        "Audit2003 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-26\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/watched-worktree-catalog-notification.test.ts src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.19,\n          \"summary\": \"Three watcher/runtime/wiring files passed with 38 tests, including two-client publication, reconnect, stale scan fencing, headless parity, owner-collision suppression, failure isolation, and main-window notifier wiring. Historical run: the watched-worktree-catalog-notification suite was later removed as mock forwarding coverage; it is not an active gate or replacement-equivalence claim.\"\n        }",
        "Module layout SSH policy: Retire reset/private-arithmetic generation rollover registrations. The two retained local-versus-SSH mutation refusals do not establish process-scope rollover or sibling-token invalidation; remove this unrelated gate selector and its rollover assertion claim. Unchanged unrelated execution receipts retain only their original scope. No replacement, fresh rollover execution or cross-platform proof is claimed.",
        "Historical SSH generation selector and assertion metadata before policy retirement, preserved verbatim; not current coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/connection/authority/ssh-connection-generation.test.ts --reporter=dot\"\n\"src/main/ssh/connection/authority/ssh-connection-generation.test.ts\"\n{\n          \"file\": \"src/main/ssh/connection/authority/ssh-connection-generation.test.ts\",\n          \"assertions\": [\n            \"one exhausted target rolls the process generation scope and invalidates every sibling target token\",\n            \"old-scope mutation expectations fail while the new-scope authority continues rotating\"\n          ]\n        }",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  All earlier notes and dated/archived evidence retain original scopes.",
        "Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/workspaces/catalog/external-worktree-paired-client-discovery.integration.test.ts src/main/window/attach-main-window-services.test.ts\"",
        "Exact retired testFiles selector: \"src/main/window/attach-main-window-services.test.ts\"",
        "Complete prior assertionRef retired as historical data only: {\n          \"file\": \"src/main/window/attach-main-window-services.test.ts\",\n          \"assertions\": [\n            \"main-window wiring installs the runtime as the watched-worktree remote-client notifier alongside the existing repo notifier\"\n          ]\n        }"
      ],
      "demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if index-only churn can emit worktrees:changed, or if structural add/remove/HEAD/lock changes fail to converge."
    },
    {
      "id": "runtime.multi-client-view-isolation",
      "title": "A client's workspace create navigates only the caller unless follow is explicit",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "runtime-client-event-authority",
      "surfaces": [
        "paired desktop client",
        "paired web client",
        "headed Orca desktop server",
        "headless orca serve",
        "worktree.create with activate",
        "runtime.clientEvents stream"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "orca-server"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local", "orca-server"],
      "coverageNotes": "Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): A real two-client integration harness pairs two authenticated devices to one OrcaRuntimeService over WebSockets with E2EE and drives worktree.create through the real RPC dispatcher, in both headed-notifier and headless orca-serve shapes. The headless case is a modeled `orca serve` runtime shape — no notifier, no attached window — not a CLI bootstrap, and the in-process reveal non-regression calls createManagedWorktree directly. A headed Electron journey runs the desktop app as the remote server with two independently paired web clients in separate partitions and asserts each client's rendered active worktree. Windows and Linux are covered by the platform-neutral contract only; the reported field topology was a Windows server with mixed-OS clients. Audit1313: src/main/runtime/rpc/methods/worktree-create-navigation.test.ts: Fake runtime creation/show/dedupe under real RPC decoder only inspects forwarded navigation option matrices, with duplicate desktop case. Lose runtime/mobile/legacy CLI/follow/all navigation authority wiring; no rendered reveal. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/11027"],
      "invariant": "View intent belongs to the connection that requested it. With no explicit navigation target, a workspace create arriving over a paired desktop/web client connection activates only that caller; it must not emit an activateWorktree client event to sibling connections or drive the host renderer. An explicit navigation of host/clients/all remains an allowed, tested follow intent. Shared model state — repo/worktree catalogs, terminals, agent output — must keep propagating to every client unchanged. In-process and CLI creates keep notifying the host and all clients so a headless server's only viewer still gets its reveal.",
      "oracle": "Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): notifyActivateWorktree takes its navigation target as a required parameter, so a create call site that forgets to forward it is a compile error rather than a silent fallback to broadcasting — mutation testing confirmed all six call sites (folder, git, and remote/SSH branches, startup and no-startup each) are killed by typecheck. Behaviorally: two paired clients subscribe to runtime.clientEvents. Client A creates a workspace with activate:true; a reposChanged fence emitted after the create must be the next frame each client sees, proving no activation frame was interleaved, while worktreesChanged still arrives on both streams. The host notifier's activateWorktree is asserted not called and the host's mirrored selection is unchanged. Repeated ordinary worktree.activate calls by A are the negative control. The same file asserts the in-process create still reaches host and clients, headed and headless. The Electron journey asserts the observer's data-rendered-active-worktree-id is unchanged while the created workspace still appears in its sidebar.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts",
        "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts"
      ],
      "testFiles": [
        "src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts",
        "tests/e2e/multi-client-navigation-isolation.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts",
          "assertions": [
            "keeps a paired client workspace create-with-activate off every other client and the host",
            "still reveals to every client when a paired caller asks for all-surface navigation",
            "does not replay a missed create activation to a reconnecting observer",
            "keeps create activation caller-scoped on a headless orca serve host",
            "routes explicit host and paired-client follow intent without changing the default"
          ]
        },
        {
          "file": "tests/e2e/multi-client-navigation-isolation.spec.ts",
          "assertions": [
            "keeps a paired client workspace create-with-agent off the other client and the host",
            "keeps two paired browser clients and the host on independent worktrees"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-18",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts",
          "result": "passed",
          "durationSeconds": 80,
          "summary": "Headed Orca desktop server with two paired web clients: the observer stayed on its own worktree while the creator's workspace appeared in its sidebar. With the fix disabled the same journey failed with the observer rendering the created workspace."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "two-client WebSocket integration contracts plus one headed Electron two-web-client journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New contracts. The integration file is fence-ordered rather than timing-based and passed repeatedly locally; the Electron journey passed twice locally on macOS. CI and soak history have not started."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Both layers were observed red on origin/main 4ec6bbf588 before any fix: the observer client received ['worktreesChanged', 'activateWorktree'] instead of the fence, and the Electron observer's data-rendered-active-worktree-id resolved to the workspace the other client had just created. Both went green with the caller scoping and red again when only resolveRuntimeNavigationTarget's clientKind input was removed."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "The change adds one enum resolution per create request and two boolean checks before an existing fan-out. No new listeners, subscriptions, provider calls, or timers; the client-event fan-out itself is unchanged in shape and frequency."
      },
      "promotionCriteria": [
        "Collect CI soak history for the Electron journey on macOS plus at least one Linux run.",
        "Add a live Windows-server topology run matching the reported field setup.",
        "Extend the oracle to mobile observers and to a client with two windows open on one connection."
      ],
      "knownGaps": [
        "Audit2141: Remove only the in-memory fake-store restart callback from src/main/runtime/client/navigation/multi-client-navigation-isolation.integration.test.ts. Its copied persistence-object alarm is intentionally lost without replacement. All eight actual paired-WebSocket callbacks and five active assertion aliases remain byte-identical. Existing Electron receipt is unchanged and validates only its original source/journey; no fresh validation of the reduced integration selector, disk persistence, live remote/mobile, or cross-platform result is claimed.",
        "No live Windows or Linux server run yet; the reported field topology was a Windows 11 server.",
        "Mobile observers are covered only by the platform-neutral clientKind contract, not by a live phone journey.",
        "Host-originated CLI creates deliberately still reveal on every client; that broader authority question is untouched by this gate.",
        "Mobile creates deliberately keep the all-surface reveal: a phone has no renderer to provision repo setup/default tabs off the activation event.",
        "The Electron journey drives the store create action and does not establish the composer's automatic self-navigation. The test-value audit removed the mocked worktree-creation-flow suite and accepts loss of its separate callback/navigation alarms; no replacement coverage is claimed.",
        "Headless coverage is a modeled runtime shape; CLI bootstrap and argument parsing for orca serve are not exercised here.",
        "Host-first rollout: the fix is enforced by the host, so a NEW client paired to an OLD always-on server still sees the original cross-client jump. Shipping clients alone fixes nothing for anyone; the runtime/server must be updated. Nothing breaks under that skew — the old host simply keeps its old behavior — but release notes and support triage must check the host version, not the client version. No skew combination is worse than pre-fix main: an old CLI is recognized by its cliProvenanceRequest marker so its --activate reveal survives an updated host.",
        "A future contributor could still hardcode a wrong navigation target at a call site: the required object key makes omission a compile error, but not substitution. Only the folder/no-startup branch has a behavioral test that would catch it.",
        "Out of scope, host-only and unreachable from the product UI: a paired caller that explicitly requests terminal.create with presentation 'focused' still navigates the host renderer (the Orca client always sends 'background'); agent-session already downgrades that presentation for paired callers.",
        "Out of scope: browser.tabCreate/tabSwitch carry no paired-client navigation policy, so they can change the host's active browser tab when the host is already on that worktree. They never cross worktrees, and the paired web client sends activate:true deliberately.",
        "Audit1313: src/main/runtime/rpc/methods/worktree-create-navigation.test.ts: Fake runtime creation/show/dedupe under real RPC decoder only inspects forwarded navigation option matrices, with duplicate desktop case. Lose runtime/mobile/legacy CLI/follow/all navigation authority wiring; no rendered reveal. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1313 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-18\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/multi-client-navigation-isolation.integration.test.ts src/main/runtime/rpc/methods/worktree-create-navigation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6,\n          \"summary\": \"Eleven paired-runtime contracts pass, including the headless orca-serve shape, the in-process reveal non-regression, and the CLI-shaped explicit all-surface reveal. With the caller scoping removed the observer's stream carried activateWorktree instead of the fence.\"\n        }",
        "Audit1931 (sources1928/1929): Partial real local-loopback multi-client suite loses supplied device-metadata attribution, direct worktree-local navigation, focused terminal-create projection and crossed-two-server inventory alarms. Retire the worktree-local alias and the stale host-originated reveal-to-all alias: no surviving callback backs that positive reveal claim; the retained host-create callback instead excludes paired observers. Keep the five exact caller-only create, explicit all-surface, reconnect non-replay, headless caller-only and follow-intent aliases. No equivalent replacement or external remote-host journey is assigned. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'attributes workspace creation to each authenticated device across reconnect'; 'keeps worktree navigation local to each paired runtime client by default'; 'normalizes a paired focused terminal.create before host-renderer activation'; 'isolates crossed clients across two runtime servers'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/multi-client-navigation-isolation.integration.test.ts\",\n          \"assertions\": [\n            \"keeps a paired client workspace create-with-activate off every other client and the host\",\n            \"still reveals to every client when a paired caller asks for all-surface navigation\",\n            \"does not replay a missed create activation to a reconnecting observer\",\n            \"keeps create activation caller-scoped on a headless orca serve host\",\n            \"still reveals a host-originated create-with-activate on the host and every client\",\n            \"keeps worktree navigation local to each paired runtime client by default\",\n            \"routes explicit host and paired-client follow intent without changing the default\"\n          ]\n        }"
      ],
      "demotionRule": "Demote if a create, activate, or reveal path can move a viewer that did not request it, or if scoping regresses the in-process/CLI reveal that a headless server's only remote viewer depends on."
    },
    {
      "id": "runtime.headless-desktop-promotion-continuity",
      "title": "Headless serve opens its desktop without replacing live terminal sessions",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "electron-runtime-contract",
      "surfaces": [
        "headless orca serve",
        "single-instance desktop activation",
        "CLI open",
        "persistent terminal reattach",
        "update install handoff"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": [],
      "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2271: Linux coverage is limited to the unchanged serve-signal-exit-diagnostic supervisor selector and the late-handoff-after-child-exit assertion recorded below. It does not cover desktop promotion, renderer continuity, persistent PTYs or native updater behavior. No current local, daemon or SSH provider execution is established; coveredProviders is empty. Historical macOS/provider scope remains only in preserved prior accounts and archived receipts. Audit2252 removes the entire handassembled serve promotion/renderer hydration suite. Retired alarms: queued and repeated activation coalescing, duplicate serve suppression, unavailable-provider diagnostic, and zero resume/replacement accounting on independently supplied renderer state. The fixture never joined actual daemon-to-renderer delivery. These exact alarms have no equivalent replacement assigned. Remaining gate selectors keep their existing narrower scope; historical dated receipts remain verbatim and do not validate this changed selector set. No fresh runtime, native/provider, live remote/mobile, cross-platform or performance result is claimed. Archived removed active entries verbatim: commands: \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\ntestFiles: \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\"\nassertionRefs: {\n          \"file\": \"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\",\n          \"assertions\": [\n            \"a forced desktop relaunch reaching the headless lock owner opens exactly one window, and only after the persistent provider settles\",\n            \"a duplicate `orca serve` launch never promotes the headless owner\",\n            \"the renderer promoted inside the serve process resumes zero agents while daemon panes survive, before and after those panes rebind their PTYs\",\n            \"no replacement resume tab, startup command, or automatic-resume claim is created, and every surviving session record is left untouched\"\n          ]\n        } Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged. Historical scope before this audit: Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/8457",
        "https://github.com/stablyai/orca/issues/9563"
      ],
      "invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Once a supervised child exits or fails to start, no late handoff completion may signal it or arm force-kill escalation. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.",
      "oracle": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2252: The removed synthetic lock/gate/hydration fixture supplies no current promotion continuity oracle. Existing other selectors retain only their own independent scope; changed selector execution is pending. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/construction/orca-runtime.test.ts",
        "pnpm exec electron-vite build --mode e2e",
        "pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1"
      ],
      "testFiles": [
        "src/main/updater/updater.headless-serve-install.test.ts",
        "src/main/updater/serve-update-handoff.test.ts",
        "src/cli/runtime/launch.test.ts",
        "src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
        "src/main/startup/serve-desktop-activation.test.ts",
        "src/cli/runtime-client.test.ts",
        "src/cli/runtime/websocket-transport.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "tests/e2e/headless-serve-desktop-activation.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/updater/updater.headless-serve-install.test.ts",
          "assertions": [
            "a ready update in headless serve is deferred before native install, paired-client disconnect, or active-session cleanup",
            "a supervised serve persists handoff after checkpoints but before native quit and uses no native GUI relaunch",
            "unsupported serve refuses updater staging and install-on-quit while preserving availability checks",
            "a failed handoff preflight preserves the serving owner before native quit or PTY cleanup",
            "macOS installer-readiness timeout cannot quit a headless serving owner",
            "ordinary macOS app quit is not reinterpreted as an install request in headless serve mode",
            "repeated requests emit one deterministic status and lifecycle diagnostic while interactive installs remain unchanged"
          ]
        },
        {
          "file": "src/cli/runtime/launch.test.ts",
          "assertions": [
            "waits past startup status lines for valid recipe JSON",
            "preserves UTF-8 recipe JSON split across Buffer chunks"
          ]
        },
        {
          "file": "src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
          "assertions": ["late update handoff failure cannot rearm termination after child exit"]
        },
        {
          "file": "src/main/updater/serve-update-handoff.test.ts",
          "assertions": [
            "install intent and failure state are written atomically under canonical user data",
            "an injected handoff path outside canonical user data cannot authorize an update",
            "a target-version startup clears stale failure state"
          ]
        },
        {
          "file": "src/main/startup/serve-desktop-activation.test.ts",
          "assertions": [
            "early activation requests coalesce until the persistent provider is ready",
            "a blocked provider drops pending activation and never opens a window"
          ]
        },
        {
          "file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
          "assertions": [
            "desktop activation keeps the same main owner PID, runtime id, daemon PID, and PTY id",
            "terminal output written before promotion remains visible and post-promotion input/output still works",
            "the activating second process exits instead of becoming another owner"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-11-08",
          "runner": "local",
          "platform": "linux",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts",
          "result": "passed",
          "durationSeconds": 0.615,
          "summary": "12 tests passed in the unchanged serve-signal-exit-diagnostic root on an isolated background Linux runner. Gate evidence is limited to the real supervisor refusing late handoff-completion termination after an injected child exit; the test uses a fake child/events, fake timers and a temporary missing handoff path. No native updater, macOS/Windows, persistent PTY, promoted renderer, provider or remote execution was established. This is no equivalent replacement for the deleted serve-continuity suite."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused unit contracts plus one isolated Electron headless-to-desktop journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New deterministic contracts and two consecutive local macOS Electron passes; CI and cross-platform soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): The original updater regression was observed red with one native install call, one paired-client disconnect, one cleanup start, no replacement owner, and a stranded staged installer. The root-cause harness was then observed red because the Electron child received no handoff path and the CLI parent exited, allowing launchd to spawn the old version while ShipIt still required zero running target apps. A live canary then exposed MacUpdater ignoring quitAndInstall relaunch arguments and starting a second desktop owner; disabling its independent relaunch for supervised mode produced one stable LaunchAgent parent, one verified replacement, and a surviving session across the real ShipIt swap. The final deterministic harness keeps that parent, observes the atomic bundle swap, and verifies the new serving version before clearing state. Earlier activation evidence also fixed second-owner and replacement-PTY failures. Historical receipts before removing the source-only tests, preserved verbatim with their originally executed commands (the narrowed commands were not rerun here): [{\"date\":\"2026-07-21\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/serve-update-handoff.test.ts src/main/updater.headless-serve-install.test.ts src/main/updater.test.ts src/main/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts\",\"result\":\"passed\",\"durationSeconds\":5,\"summary\":\"Seven focused files passed with 133 tests. The lifecycle harness keeps the CLI parent alive across an atomic .app replacement, starts one target-version serve replacement, and requires its bounded readiness message. Unsupported and failed-preflight paths make zero native install and PTY-cleanup calls; supervised native install leaves the modeled daemon session intact and suppresses native GUI relaunch.\"},{\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts\",\"result\":\"passed\",\"durationSeconds\":13,\"summary\":\"Seven activation, ownership, quit, local/remote CLI, and runtime contract files passed with 704 tests, including first and repeated windowless reattach, local/SSH identity transfer, ordinary desktop persistence isolation, and dynamic side-effect scanner gating.\"}]"
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Normal serve and desktop paths add only constant-time mode checks plus one IPC listener on the macOS CLI child. During an actual install handoff only, the CLI watches the stable app parent directory and performs a bounded 250ms version-file poll for at most 120 seconds; there are no subprocesses, network calls, provider scans, or startup waits. Activation performance is unchanged."
      },
      "promotionCriteria": [
        "Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
        "Add live packaged activation coverage on macOS plus representative Linux and Windows single-instance journeys.",
        "Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract."
      ],
      "knownGaps": [
        "Audit2271: Retire the deleted serve-desktop-promotion-session-continuity suite receipt from structured evidenceRuns. The exact dated original object is preserved below as historical text, including its prior claims; it supplies no current promotion/renderer continuity or equivalent replacement evidence. The replacement structured receipt covers only the unchanged serve-signal-exit-diagnostic selector and its late-handoff-after-child-exit supervisor assertion. No promoted-renderer, persistent-PTY, native Electron, provider, remote or platform execution equivalence is assigned. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2,\n          \"summary\": \"Six tests passed joining the serve lock owner, the activation gate, and the promoted renderer's resume accounting. Red evidence: reverting the hidden-pane ownership predicate launched two duplicate codex resume tabs; additionally zeroing the live-PTY check made both hydration passes red; removing the duplicate-serve argv guard opened a window for `--serve`; always marking the gate ready removed the fail-closed diagnostic; refusing to open a window dropped both promotion assertions.\"\n        }",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 52,\n          \"summary\": \"The isolated Electron journey passed repeatedly on the final source; the latest 51.6-second run retained the same main owner, runtime, daemon, and PTY, restored pre-promotion output, accepted post-promotion input, and observed the activating process exit.\"\n        }",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1589 removes mock-only CLI forwarding, canned provisioning/catalog/error projections and private inventories without equivalent replacement coverage. Retained cases exercise actual local markdown/paste/reconciliation, stream framing/backpressure/output-drain, temporary directory cleanup and persisted handoff with injected host/provider/process boundaries. No real Jira, provisioning, remote launch, native pipe/process-tree authority or deployed provider catalog proof. Assertion references use the surviving handoff registration titles; changed-selector historical receipts are retired and unaffected receipts remain unchanged.",
        "The Electron journey uses an isolated development bundle rather than the installed application so it cannot disturb a real user session.",
        "The live ShipIt/LaunchAgent canary used a disposable minimal Electron bundle plus the compiled production supervisor; a full packaged Orca update has not yet been run.",
        "Linux and Windows single-instance activation have unit coverage but no live Electron evidence yet.",
        "SSH identity transfer is deterministic unit coverage only; the live Electron journey currently exercises the local daemon provider.",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"the headless sentinel transfers authority to the first real window\",\"headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence\",\"status distinguishes available, openable, initializing, and blocked desktop states\",\"desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready\"]}]",
        "Audit2020: Retire CLI supervisor outcome, local-open promotion and paired-open projection alarms; launch retains only the two referenced stream-framing cases. Remaining CLI refusal/timeout cases do not replace headless-promotion coverage. Preserve both independent dated receipts at their original commands. Reduced selectors have no fresh result or equivalent replacement claim.",
        "Audit2020 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/cli/runtime/launch.test.ts\",\n          \"assertions\": [\n            \"waits past startup status lines for valid recipe JSON\",\n            \"preserves UTF-8 recipe JSON split across Buffer chunks\",\n            \"rejects when the server exits without valid recipe JSON\",\n            \"accepts valid recipe JSON at exit without a trailing newline\"\n          ]\n        }",
        "Audit2020 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/cli/runtime-client.test.ts\",\n          \"assertions\": [\n            \"local open activates a reachable headless owner and waits for a desktop window\",\n            \"unsafe promotion returns an explicit blocked error instead of launching a second owner\"\n          ]\n        }",
        "Audit2020 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/cli/runtime/websocket-transport.test.ts\",\n          \"assertions\": [\n            \"remote-paired open reports remote desktop state without launching a local app\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  All earlier notes and dated/archived evidence retain original scopes.",
        "Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts\""
      ],
      "demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit."
    },
    {
      "id": "runtime.renderer-graph-reload-termination",
      "title": "Renderer graph reloads terminate under exact document and window authority",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "electron-runtime-contract",
      "surfaces": [
        "desktop renderer reload and crash recovery",
        "headless-to-desktop promotion",
        "CLI and paired-runtime graph availability"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "paired-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local", "daemon", "paired-runtime"],
      "coverageNotes": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/14066",
        "https://linear.app/stably/issue/STA-4016",
        "https://github.com/stablyai/orca/pull/14070"
      ],
      "invariant": "Every genuine renderer graph reload revision settles exactly once, while a blocked external navigation that preserves the current document never starts a revision. A cancelled renderer-document navigation restores authority only when that same renderer survived; cancellation after an earlier document committed remains fenced until publication or timeout. Replacing a reload cancels only the prior revision; its timer and callbacks cannot settle a newer revision. A desktop reload succeeds only from a publication carrying a new renderer-document generation, while a failed headless promotion may recover only from its originating window. Timeout, renderer loss, and close reach a terminal graph state, and successful desktop publication permanently retires headless sentinel fallback until a new headless runtime is established.",
      "oracle": "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts",
        "pnpm exec electron-vite build --mode e2e",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test e2e/headless-serve-desktop-activation.spec.ts tests/e2e/headless-serve-desktop-activation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts",
        "src/main/window/runtime-renderer-notification-sender.test.ts",
        "src/main/window/renderer-document-navigation.test.ts",
        "src/main/ipc/runtime.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts",
        "tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts",
        "tests/e2e/renderer-crash-recovery-terminal-input.spec.ts",
        "tests/e2e/headless-serve-desktop-activation.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts",
          "assertions": [
            "each revision settles exactly once",
            "replacement cancels the old revision and fences its timeout",
            "settlement and timeout release their timers"
          ]
        },
        {
          "file": "src/main/window/runtime-renderer-notification-sender.test.ts",
          "assertions": [
            "renderer failure is contained once per load generation",
            "late events cannot revive a closed sender"
          ]
        },
        {
          "file": "src/main/window/renderer-document-navigation.test.ts",
          "assertions": [
            "blocked external navigation does not start a renderer generation",
            "only the packaged renderer file or development origin starts a renderer generation",
            "concurrent provisional starts share one reload fence and cancel only after every attempt fails"
          ]
        },
        {
          "file": "tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts",
          "assertions": [
            "blocked external navigation starts and stops loading without replacing the renderer document",
            "runtime graph epoch, readiness, and authoritative window remain unchanged",
            "a later listener can cancel a renderer navigation while its canary and authoritative graph recover"
          ]
        },
        {
          "file": "tests/e2e/renderer-crash-recovery-terminal-input.spec.ts",
          "assertions": [
            "main observes renderer process loss and a completed recovery load",
            "the same daemon-backed PTY remains reachable through transport and direct-write probes"
          ]
        },
        {
          "file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
          "assertions": [
            "promotion preserves main owner, runtime, daemon, and PTY identity",
            "terminal output survives promotion and post-promotion input/output remains live"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-14",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 8,
          "summary": "Two isolated Electron flows passed: blocked external navigation left epoch and authority unchanged, and a same-renderer navigation cancelled by a later listener preserved its canary while returning the incremented graph generation to ready under the same authoritative window.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-13",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 18,
          "summary": "Two forced renderer process deaths each produced a main-observed recovery load; the same daemon-backed PTY remained live through renderer transport and direct-write probes.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-13",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test e2e/headless-serve-desktop-activation.spec.ts tests/e2e/headless-serve-desktop-activation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 10,
          "summary": "The isolated headless serve owner promoted to a real renderer while preserving main owner, runtime, daemon, and PTY identity. Pre-promotion output remained visible and post-promotion terminal input/output succeeded; a full-window proof image records both markers.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test e2e/headless-serve-desktop-activation.spec.ts tests/e2e/headless-serve-desktop-activation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 420,
        "scope": "focused deterministic contracts plus isolated forced-crash and headless-promotion Electron journeys"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Fresh deterministic and two isolated Electron journeys are green; CI soak history is pending."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): A byte-identical three-case oracle was rerun on 2026-08-13. Latest main ee8dd4796e failed all three: reload remained reloading after 22.5 seconds, the prior renderer document settled the replacement, and a competing window stole failed-promotion authority. Submitted PR head feeca6c22f passed the bounded replacement timeout but failed both authority cases. The locally rewritten candidate passed all three. Disabling the local document-generation and pending-window fences reproduces the submitted-head failures; disabling the cancelled-navigation classifier leaves the graph reloading and increments its epoch in the new live oracle."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Fresh delegated audit passed with no blocking, major, or actionable minor findings. The candidate retains at most one unref'd timer, reuses the existing renderer document UUID, adds about 67 serialized bytes to each already-coalesced local graph IPC, and performs constant-time generation/window checks. It adds no polling, subprocess, network request, remote frame, provider scan, or steady-state fanout; a dedicated benchmark would measure existing graph/structured-clone noise rather than meaningful incremental work."
      },
      "promotionCriteria": [
        "Collect CI and soak history without unexplained flakes.",
        "Collect live Linux and Windows desktop reload evidence.",
        "Add live SSH or WSL promotion evidence if provider-specific graph restoration diverges."
      ],
      "knownGaps": [
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The live journeys cover macOS and daemon-backed local terminals, not Linux desktop, Windows, WSL, or SSH promotion.",
        "The same-frame stale-document race is deterministic fault injection because Playwright cannot schedule an invoke precisely between did-start-loading and frame replacement.",
        "No mixed-version live run is required because rendererGeneration is confined to same-version preload/main Electron IPC and the remote runtime wire is unchanged.",
        "The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts\",\"result\":\"passed\",\"durationSeconds\":12,\"summary\":\"Eight focused files passed with 1,175 tests and one pre-existing skip after the merge from latest main. The suite covers exact reload settlement, timeout replacement, cancelled-navigation recovery, concurrent provisional starts, document and window authority, notification containment, preload IPC, and renderer publication scheduling.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"only the newest reload owns the terminal timeout\",\"a superseded renderer-document generation cannot settle a reload\",\"cancelled navigation restores only the renderer or headless authority that actually survived\",\"cancellation after an earlier document commit stays fenced until its restarted timeout\",\"failed headless promotion remains pinned to its originating window\",\"successful desktop publication retires headless fallback\"]}]",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. The whole main-window attach-services suite is removed: runtime/window attach, notifier wiring, reload/teardown and permission-handler mock orchestration alarms are intentionally lost. Prune its exact deleted command selectors, testFiles entries and notifier assertionRef where present; complete prior selectors/ref are archived. Unrelated dated receipts remain exact and retain their original scope; no fresh reduced-selector, native-window or remote execution is claimed.  All earlier notes and dated/archived evidence retain original scopes.",
        "Exact prior command before deleted attach-main-window-services selector removal: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-graph/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-payload-partition.test.ts\"",
        "Exact retired testFiles selector: \"src/main/window/attach-main-window-services.test.ts\""
      ],
      "demotionRule": "Demote if a reload revision settles more than once, a stale document or competing window can publish, a timer survives settlement, desktop failure stays indefinitely reloading, headless fallback returns after successful promotion, or either isolated Electron journey loses runtime or PTY identity."
    },
    {
      "id": "runtime.websocket-heartbeat-cadence",
      "title": "Runtime WebSockets enter an owned shared heartbeat cadence",
      "maturity": "experimental",
      "protection": "none",
      "owner": "runtime-platform",
      "layer": "websocket-transport-lifecycle",
      "surfaces": [
        "headed paired runtime",
        "headless orca serve",
        "web and mobile runtime clients"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Deterministic transport tests cover listener-before-probe ownership, first- and later-socket shared cadence, responsive and unresponsive cleanup, pause/resume, connection caps, pre-auth expiry, and close/error races. Headed paired-runtime and headless serve validation passed on macOS; live Linux and Windows heartbeat evidence remains uncollected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11298",
        "https://github.com/stablyai/orca/pull/11300"
      ],
      "invariant": "Every accepted runtime socket installs message, pong, close, and error ownership before any heartbeat probe. Unauthenticated sockets receive no heartbeat control frames during E2EE and are bounded by the pre-auth timeout; authenticated sockets share one periodic cadence, tolerate missed probes and event-loop pause, and release listeners and timers on close or error.",
      "oracle": "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): With one fake clock and exact socket identities, accept an authenticated first socket at 0 ms and require its first probe on the 100 ms tick. Accept an unauthenticated later socket at 50 ms and require no probe at the 100 ms tick; authenticate it, then require its first probe on the next shared tick and termination only after the configured consecutive-miss budget. Inject synchronous message, pong, close, and error events, then require exact heartbeat membership and zero retained timers/listeners after final close. Production transport tests independently cover real socket round trips, pre-auth and capacity bounds, revocation, shutdown, and half-open cleanup.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "focused runtime WebSocket heartbeat and transport tests"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Deterministic fake-clock and local socket coverage passed on macOS; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): On the candidate before this review fix, an authenticated first socket kept the shared timer alive while an unauthenticated socket accepted at 50 ms was pinged at the 100 ms tick; the new oracle failed. After filtering heartbeat clients to the authenticated transport map, the same byte-identical oracle passes: no pre-auth ping, first post-auth probe on the next shared tick, and bounded cleanup."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): The transport retains exactly one shared interval, performs one O(N) sweep per tick, and adds no per-socket heartbeat timer, polling, subprocess, network request, or immediate later-socket sweep. Each accepted socket retains only its existing lifecycle listeners and pre-auth timer; deterministic assertions preserve the shared timer identity and bound final cleanup to zero timers."
      },
      "promotionCriteria": [
        "Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
        "Collect live Linux and Windows paired-runtime heartbeat evidence.",
        "Add a multi-client live fanout run that confirms shared-cadence cleanup under connection churn."
      ],
      "knownGaps": [
        "Live paired-runtime validation currently covers macOS only.",
        "The later-socket bound is deterministic fake-clock coverage; live scheduler jitter is not measured.",
        "Multi-client churn and sleep/wake fanout remain live-test gaps.",
        "Audit1991: Remove membership/timer and error-close inventory aliases and the raw-TCP-cap alias from the changed transport source. Retire the sole dated combined42-case receipt whole. Downgrade to no active evidence; archive all prospective commands, file/assertion aliases and covered-scope fields rather than transfer their authority to unchanged sibling suites. Real oversized-message closure, pre-auth expiry, revocation, half-open cleanup and bounded shutdown callbacks remain in source but have no fresh gate result. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1991 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/ws-transport-accept-order.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/ws-transport.test.ts src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.91,\n          \"summary\": \"Four runtime transport files and 42 tests passed with deterministic authenticated heartbeat cadence, handshake grace for later sockets, exact listener/timer ownership, pause recovery, transient packet-loss tolerance, security bounds, and cleanup.\"\n        }",
        "Audit1991 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/ws-transport-accept-order.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/ws-transport.test.ts src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts\"",
        "Audit1991 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/ws-transport-accept-order.test.ts\"",
        "Audit1991 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\"",
        "Audit1991 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/ws-transport.test.ts\"",
        "Audit1991 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts\"",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/ws-transport-accept-order.test.ts\",\n          \"assertions\": [\n            \"the first periodic probe observes message, pong, close, and error ownership\",\n            \"an authenticated unresponsive socket is reaped on the configured consecutive-miss budget\",\n            \"an unauthenticated later socket is not probed before authentication, then joins the original shared timer\",\n            \"final close releases heartbeat membership, listeners, and timers\"\n          ]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\",\n          \"assertions\": [\n            \"a single missed probe does not reap the unresponsive client\",\n            \"event-loop resume grants clients a fresh probe\"\n          ]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/ws-transport.test.ts\",\n          \"assertions\": [\n            \"heartbeat arming and shutdown follow accepted connection membership\",\n            \"pre-auth, raw TCP, and accepted WebSocket resource bounds remain enforced\",\n            \"error and close races finalize membership once\"\n          ]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts\",\n          \"assertions\": [\n            \"an authenticated real WebSocket survives one swallowed pong and responds to later probes\"\n          ]\n        }",
        "Audit1991 historical original coveredPlatforms object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"macos\"]",
        "Audit1991 historical original coveredProviders object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"remote-runtime\"]"
      ],
      "demotionRule": "Demote if any probe can run before lifecycle ownership, if more than one shared heartbeat timer is armed, if first-socket cleanup exceeds one interval, if later-socket cleanup exceeds two intervals, or if close/error cleanup retains listeners or timers."
    },
    {
      "id": "runtime.streaming-subscription-close-delivery",
      "title": "Retiring a runtime transport always tells the renderer its streams closed",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "runtime-subscription-ipc-contract",
      "surfaces": [
        "paired remote server",
        "runtime environment disconnect and re-pair",
        "terminal.multiplex streaming",
        "browser screencast streaming",
        "parked remote terminal reveal"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["remote-runtime"],
      "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic main-IPC contract tests cover disconnect-driven close delivery, exactly-once close, per-subscription teardown isolation against a failing socket close and a throwing liveness probe, containment of a throwing renderer send on the unguarded host-close path, and continued suppression of stale payloads from a retired transport. A headed paired-server journey (real Orca host plus a separate paired Orca desktop client) covers hidden-but-mounted reveal, cold-parked reveal, and cold-parked reveal across a disconnect/reconnect. Live Linux and Windows paired-server evidence and real sleep/wake transport loss remain uncollected.",
      "motivatingLinks": ["tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts"],
      "invariant": "Every renderer-held runtime subscription receives exactly one terminal close event when its transport is retired, including when the retirement advanced the transport generation first, and a single failing teardown never abandons that environment's remaining subscriptions nor escapes into the transport that reported the close. Payload frames from a retired transport stay suppressed. A revealed remote terminal therefore reattaches over a live multiplex connection: its buffer restores, typed input reaches the host PTY, the echo paints without a tab flip, and the PTY converges on the revealed pane grid.",
      "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): The main IPC contract test subscribes terminal.multiplex through the real handler, disconnects the environment, and asserts the renderer received exactly one {type: close} subscription event. Two isolation tests subscribe a second stream to the same environment and make the first one fail -- in its socket close, and in the liveness probe inside notifyClosed -- then assert the disconnect does not throw, both transports closed, and every close the renderer could still receive was delivered. A third drives a host-initiated close through the transport callback, which is the one notifyClosed call site with no surrounding guard, with a renderer send that throws, and asserts it cannot escape into the WebSocket close handler. A fourth test asserts that after retirement a late response frame is not forwarded and a late transport close does not re-send. The paired-server journey runs three reveal scenarios against one real host and one real paired desktop client, and for each records buffer restore, host-side receipt of the typed marker through an out-of-band host sink file, live paint without a tab flip, and PTY-versus-pane grid convergence.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts",
        "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": ["tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts",
          "assertions": [
            "a revealed hidden-but-mounted remote terminal restores, accepts input, and paints live",
            "a revealed cold-parked remote terminal restores, accepts input, and paints live",
            "a cold-parked remote terminal revealed after a runtime disconnect and reconnect restores, accepts input, and paints live",
            "the host PTY grid converges on the revealed pane grid in every scenario"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-03",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 15.5,
          "summary": "All three reveal scenarios restored their buffer, delivered typed input to the host PTY, painted live without a tab flip, and converged the PTY on the 135x60 pane grid. Before the fix the reconnect-parked scenario stayed blank at recoveryState connecting with the PTY stranded at the host 128x60 grid."
        },
        {
          "date": "2026-08-03",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 15.5,
          "summary": "Repeat run on a clean uninstrumented build; all three scenarios green with identical grids."
        },
        {
          "date": "2026-08-03",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 14.7,
          "summary": "Third consecutive pass after the review follow-ups (env save/restore and the hidden-mounted stayed-mounted assertion)."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "focused runtime environment IPC tests plus one headed paired-server reveal journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Deterministic IPC coverage plus the three recorded paired-server journey runs, which passed consecutively on macOS at 14.7-15.5s; the spec also passed once on a shared CI runner. Longer soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): On main the paired-server journey reproduced a blank, non-interactive pane after revealing a cold-parked remote terminal across a reconnect: recoveryState stayed connecting, the xterm buffer stayed empty, typed input never reached the host sink, a tab flip did not recover it, and the PTY stayed at the host 128x60 grid. Renderer instrumentation showed the multiplexer reusing a dead subscription (ensureConnected reuse-ready) and never receiving a subscribed event. Reverting the main-side fix also turns the close-delivery IPC test red; with the fix the multiplexer observes handleClose, reconnects fresh, and every scenario passes."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The fix adds one boolean latch and at most one extra IPC send per retired subscription, on a path that already tears the subscription down. It introduces no timer, poll, retry, subprocess, or per-frame work, and the close is deduplicated so a transport-driven close after an environment-wide retirement sends nothing."
      },
      "promotionCriteria": [
        "Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
        "Collect live Linux and Windows paired-server reveal evidence.",
        "Add real sleep/wake and network-loss transport drops alongside the explicit disconnect trigger."
      ],
      "knownGaps": [
        "Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations  / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Live paired-server validation currently covers macOS host and client only.",
        "The transport drop is an explicit runtime disconnect; real sleep/wake and network partitions are not yet exercised by this gate.",
        "Browser screencast subscribers now have deterministic shared-stream fanout coverage; a full headed reveal journey for multiple simultaneous viewers remains uncollected, while web and mobile clients continue to use their parallel transports.",
        "Audit2377/2381 removes bundled-skill eligibility5 silent late-writer successful backup, layouts1 global forced backup, legacy-auto-update2 old release plus extra notes, and native-discovery7/13/18/19/21 OpenCode project, Pi home symlink, default Hermes root, requested-cwd agents symlink and standalone SSH-builder paired cwd checks. Lose those exact backupPath/bytes/global-link-lock/history/provider/label/path combinations and localized SSH-builder sample. Retained common owners are not identical replacements; no fresh validation is claimed for this reduced broad command.",
        "Audit2383 removes the complete antigravity-skill-discovery.test.ts suite. Lose the exact .gemini/config/skills path, home-antigravity source, antigravity owner, existence and contributing-root observation. Other providers exercise common discovery dispatch, not this exact catalogue row. No equivalent replacement or fresh validation of the reduced broad command is claimed.",
        "Audit2385 removes finder regular-depth and direct missing-root examples, the three-row staging-name matrix, and an initial unknown WSL-list record sample. Lose those isolated fixtures, exact backup name spellings and malformed prefix sequence; retained actual owners are not identical replacements. Missing-root case did not model disappearance after the production caller existence check. No fresh validation of this reduced broad command is claimed.",
        "Audit2389 removes whole skill-install-preview.test.ts plus destinations1 and recovery2. Lose missing-preview name/state/global identity/fixed codex+claude inventory, exact plain-global host identity return, and already-published receipt finalization fixture. No nonmutation assertion existed in preview; retained real home delivery and placed-canonical recovery are not identical complete replacements. No fresh validation is claimed.",
        "Audit2393 refresh2401 removes skill-installation original1 and only the original receiptless request case. Lose uninterrupted first-install status/exact placement count and public canonical receiptless conflict/unowned routing. Retain upstream request ownership tests and lower transaction interruption coverage byte-exact. Deleted guard case had no directory/content preservation assertion. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2397 review amendment removes whole empty-gzip, WSL provider error-mapping and remote-cancellation registry suites; two initial hostname-suffix/userinfo URL rows and initial-expired grant sample; linked-parent alias classification. Lose no-input custom gzip branch, WSL failure labels, basic registry lifecycle/duplicate-ID guard, exact hostname-suffix/userinfo input variants, prefetch expired-grant no-network and preexisting alias result alarms. Preserve the single initial wrong-port origin authorization case, original abort-after-begin cleanup/no-signal cancelUpload dispatch suite and original independent-copy modified-digest removable=false case. No equivalent complete replacement or fresh validation claimed for the remaining losses.",
        "Audit2404 removes whole skill-share-package-name.test.ts, skill-delete-plan original1/6 skill-delete-recovery original2 and skill-share-preparation original2. Lose lookup503 rejection/status propagation through prepare, explicit unblocked unordered alias-kind/canonical sample with cwd undefined, stale classification after +60000ms actual mtime change, successful first-pass single-move rollback/staged-path absence and prior-process preparation-root archive directory cleanup. Retained exact identities use cwd home; public stale guard submits timestamp1; recovery retry cases are not identical first-pass fixtures. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2412 removes whole useVirtualizedScrollAnchor.marks-restore-signal.test.ts (six fake-hook geometry/mark/convergence/user-takeover/clamp alarms), use-task-creation-draft-retention original3/4 (immediate discard mock-call count/unopened no-write), use-terminal-bulk-close-actions.placement original6/7 (absent new-agent append and one real history-publication count at consumed3/30 scale), PendingNativeChatCreation original6 (unmounted abort completion/timer cleanup), and wsl-move-dialog-store original1/9/13 (default whole-distro count/reference/reuse and rejected-preview/start refusal recovery). The history counter measures genuine publication work without entries/order/reopen assertions; its unique batching alarm is intentionally retired. Fake React scroll tests ignore dependency scheduling and cleanup; unique simulated arithmetic alarms are deliberately lost. Retained existing-terminal reorder is not new-agent append coverage; mounted handoff timeout is not abort coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2417 removes commit-actions-real-git original3/4 (ordinary clean cherry-pick and revert content, subject and current-branch samples), and pty-startup-ingress-exited-asker original8/12 (actual foreground-group read budget across100queued queries, and zero foreground reads across100normal chunks plus final emitted/accepted raw cursor equality). Counters measure actual callback work and scale is consumed; these internal-work alarms are deliberately retired. Retained unborn, conflict and sequencer cases are not equivalent ordinary-success coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2425 removes use-workspace-copy-status original5, which returns a fixture-supplied readError string through statusReadError. No consumer blocker or attempted branch switch established refusal; the unique error-forwarding sample is intentionally retired. Other copy ownership and stale-refresh cases are not equivalent error-path coverage. No equivalent replacement or fresh validation is claimed.",
        "Audit2432 removes BranchPicker.test.tsx original3, which only asserted onOpenChange(true/false) with an always-mounted mocked Popover. It never reopened the picker or consumed the callback in the parent status-refresh owner, despite its title. Lose that unique open/close notification alarm. Retained blocker/collision recovery and asynchronous post-unmount outcome cases are not equivalent replacement coverage. No fresh validation of the reduced selector is claimed.",
        "Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed.",
        "Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed.",
        "Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed.",
        "Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed.",
        "Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation.",
        "Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed.",
        "Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked.",
        "Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed.",
        "Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms.",
        "Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery.",
        "Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction.",
        "Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed.",
        "Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed.",
        "Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed.",
        "Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed.",
        "Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed.",
        "Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired.",
        "Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands.",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical.",
        "Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed.",
        "Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed.",
        "Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed.",
        "Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope.",
        "Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope.",
        "Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope.",
        "Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts\",\n        \"pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\"tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts\"]\nassertionRefs: [\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts\",\n          \"assertions\": [\n            \"a revealed hidden-but-mounted remote terminal restores, accepts input, and paints live\",\n            \"a revealed cold-parked remote terminal restores, accepts input, and paints live\",\n            \"a cold-parked remote terminal revealed after a runtime disconnect and reconnect restores, accepts input, and paints live\",\n            \"the host PTY grid converges on the revealed pane grid in every scenario\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  All earlier notes and dated/archived evidence retain original scopes.",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed.  Earlier notes and dated/archived evidence retain original scopes.",
        "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. All prior notes and archived receipts retain original scopes.",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Earlier notes, complete dated receipts and archived gaps retain their original scopes."
      ],
      "demotionRule": "Demote if a retired runtime transport can leave a renderer subscription without a close event, if a close is delivered more than once, if one failing teardown strands its sibling subscriptions, if payload frames from a retired transport reach the renderer, or if a revealed remote terminal can stay blank or reject input after a reconnect."
    },
    {
      "id": "browser-session.remote-terminal-link-ownership",
      "title": "Paired terminal links open one browser on their owning runtime",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "renderer-paired-runtime-routing",
      "surfaces": [
        "paired remote terminal HTTP links",
        "terminal link action destinations",
        "runtime-owned managed browser creation"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime", "ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit1931 (sources1928/1929): Delete both complete runtime-host HTTP-link and link-action routing suites. Lose supplied OSC/WebLinksAddon/fallback/direct-SSH opener forwarding, manufactured gesture/mouse-ownership and local/remote destination/popover/URI argument matrices. Remove both duplicate unit commands rather than creating an unfiltered test command. Retire the two runtime-link aliases. Preserve unchanged paired Electron selectors and their own dated receipts; they are not equivalent replacements for removed unit cases. No real browser, SSH transport, pointer gesture or rendered popover ran in the deleted suites. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A headed macOS desktop host and separate paired Electron client exercise a real mirrored terminal link, owner-asserted host browser creation, exact host/client page identity, rendered DOM, explicit browser-tab activation, client external-browser suppression, exact host/client close convergence, and continued original-PTY liveness. Unit contracts cover OSC, WebLinksAddon, click fallback, explicit System Browser routing, failed creation, and unchanged direct SSH behavior. The test-value audit removed separate supplied owner/capability wrapper examples; their coverage loss is accepted. Audit1342: src/renderer/src/lib/workspace-browser-tab-open.test.ts removed. Asserted/unknown runtime create fallback refusal, invalid URL/unresolved owner and query-free error envelope alarms disappear. src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts removed. Default/inverted/Mac/Ctrl/action-menu wording and local/remote/SSH/capability hint-option matrices disappear. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1786567689897109",
        "https://github.com/stablyai/orca/issues/12418"
      ],
      "invariant": "Selecting Orca Browser for an HTTP link in a runtime-owned terminal creates exactly one browser page on that owning runtime and exactly one mirrored client browser workspace, with matching remote page identity and no client external-browser call. Explicit System Browser remains client-owned, direct SSH remains system-browser-only, and unknown or mismatched owners fail closed.",
      "oracle": "Audit1931 (sources1928/1929): Delete both complete runtime-host HTTP-link and link-action routing suites. Lose supplied OSC/WebLinksAddon/fallback/direct-SSH opener forwarding, manufactured gesture/mouse-ownership and local/remote destination/popover/URI argument matrices. Remove both duplicate unit commands rather than creating an unfiltered test command. Retire the two runtime-link aliases. Preserve unchanged paired Electron selectors and their own dated receipts; they are not equivalent replacements for removed unit cases. No real browser, SSH transport, pointer gesture or rendered popover ran in the deleted suites. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Use the focused routing contracts as the byte-identical baseline/candidate oracle. Require runtime OSC, WebLinksAddon, click fallback, action-menu, and modifier paths to target the exact owner without client fallback, while direct SSH and generic remote document links stay external. Separately run one byte-identical headed paired Electron journey on the candidate and with only runtime browser registration disabled. Require one new host browser tab, one new client mirror with exact page identity, rendered fixture DOM, explicit browser-tab activation, zero client shell.openExternal calls, exact close convergence, unchanged terminal counts, and continued output on the original PTY.",
      "commands": [
        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": ["tests/e2e/paired-remote-terminal-browser-link.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/paired-remote-terminal-browser-link.spec.ts",
          "assertions": [
            "one terminal action produces one host page and one client mirror with exact identity",
            "the host browser renders the fixture while client external navigation stays empty",
            "an explicit browser-tab click reveals the exact mirror",
            "closing the mirror returns host and client inventories to baseline",
            "the original remote PTY accepts and renders fresh output after browser close"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 32.9,
          "summary": "Candidate created one host browser and one client mirror with matching page identity, rendered the fixture, activated on an explicit tab click, made zero client external-browser calls, converged both inventories after exact UI close, and delivered fresh output on the original remote PTY."
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "failed",
          "durationSeconds": 53,
          "summary": "The byte-identical final Electron oracle failed at its exact host/client identity barrier when the sole source delta replaced src/renderer/src/store/index.ts registration lines 110-113 with registerRuntimeHttpLinkBrowserOpener(null); no host-owned browser appeared within the deterministic 60-second bound."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The focused contracts are deterministic and the headed paired-runtime journey passed locally after its PTY namespace oracle was corrected; longer CI and soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The focused owner-routing oracle is red on latest main e4c278eb523 and green on the candidate. The byte-identical headed Electron oracle is green on the candidate and red when the sole source delta replaces the runtime browser opener registration with registerRuntimeHttpLinkBrowserOpener(null); candidate evidence proves exact host/client identity, rendered content, explicit activation, exact close convergence, original-PTY survival, and absence of client external navigation."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. The production change adds no timer, polling, retry, subprocess, stream opcode, RPC method, or host publication. Each link hover or activation performs bounded in-memory owner and capability lookups; an Orca Browser action issues the same single browser creation and snapshot reconciliation already used by the tab bar."
      },
      "promotionCriteria": [
        "Collect Linux and physical Windows paired-server evidence.",
        "Collect a live headless-serve terminal-link journey.",
        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
      ],
      "knownGaps": [
        "Live paired-server validation currently covers macOS only.",
        "A live headless-serve journey and multiple simultaneous viewers are not exercised by the Electron journey.",
        "Direct SSH intentionally retains its existing system-browser-only semantics.",
        "Terminal-link activation does not change the existing asynchronous host/client focus policy.",
        "Audit1342: src/renderer/src/lib/workspace-browser-tab-open.test.ts removed. Asserted/unknown runtime create fallback refusal, invalid URL/unresolved owner and query-free error envelope alarms disappear. src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts removed. Default/inverted/Mac/Ctrl/action-menu wording and local/remote/SSH/capability hint-option matrices disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 2.58,\n          \"summary\": \"Latest main e4c278eb523 failed 6/25 owner-routing assertions: runtime terminal links called the viewing client's external browser and the managed-browser helper did not enforce an asserted runtime owner.\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts\",\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.83,\n          \"summary\": \"Candidate passed 84/84 across six focused routing, modifier, availability, owner assertion, failure, SSH, and system-browser contract files. Historical command preserved after removal of the mocked routing and modifier suites in the test-value audit; currentCommand names the remaining suites only. This historical result has not been rerun for that command and does not claim equivalent coverage.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/workspace-browser-tab-open.test.ts\",\n    \"assertions\": [\n      \"false or rejected runtime creation does not fall back to a client browser\"\n    ]\n  }\n]",
        "Audit1931 (sources1928/1929): Delete both complete runtime-host HTTP-link and link-action routing suites. Lose supplied OSC/WebLinksAddon/fallback/direct-SSH opener forwarding, manufactured gesture/mouse-ownership and local/remote destination/popover/URI argument matrices. Remove both duplicate unit commands rather than creating an unfiltered test command. Retire the two runtime-link aliases. Preserve unchanged paired Electron selectors and their own dated receipts; they are not equivalent replacements for removed unit cases. No real browser, SSH transport, pointer gesture or rendered popover ran in the deleted suites. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'opens an OSC 8 hyperlink on the owning runtime'; 'opens a WebLinksAddon click on the owning runtime'; 'opens a click-fallback activation on the owning runtime'; 'opens an OSC 8 hyperlink through the owning SSH workspace'; 'keeps a replacement request when the previous popover dismisses'; 'claims PTY mouse ownership only after the pointer gesture is eligible'; 'opens the primary destination directly when plain-click mode is enabled'; 'leaves disabled plain clicks with the terminal while middle click remains enabled'; 'keeps middle click available when plain clicks stay with the terminal'; 'leaves PTY mouse ownership with an ineligible pointer gesture'; 'leaves the action closed when the child already owns the gesture'; 'routes an explicit Orca Browser action to the owning runtime'; 'routes an explicit Orca Browser action through the owning SSH workspace'; 'uses Shift+modifier for the alternate local destination'; 'keeps Shift+modifier on the only capability-backed destination'; 'shows the raw OSC 8 file URI but copies its resolved path'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/links/http/terminal-runtime-host-link-routing.test.ts\",\n          \"assertions\": [\n            \"OSC, WebLinksAddon, and click-fallback activations route through the exact runtime owner\",\n            \"direct SSH continues to use only the system browser\"\n          ]\n        }"
      ],
      "demotionRule": "Demote if one runtime terminal link creates a client-owned or duplicate browser, targets a runtime other than the pane owner, invokes the client external browser for Orca Browser, or removes the source terminal."
    },
    {
      "id": "browser-session.remote-html-preview-ownership",
      "title": "Paired HTML previews render locally as document browser tabs and create no host browser page",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "renderer-paired-runtime-reconciliation",
      "surfaces": [
        "paired HTML file preview served locally over the orca-preview scheme",
        "preview split placement that leaves editor focus alone",
        "grant-scoped document reads, including truncation and out-of-worktree refusal",
        "capability-unknown and mixed-version browser-creation rejection cleanup",
        "post-create reconciliation failure and compensating rollback",
        "remote browser close convergence"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed. Historical coverage account before Audit1899: Audit1853 reduces LinkActionPopover.test.tsx and archives its complete 2026-09-06 mixed-selector receipt. The lost copy/open-state and Settings callback-order/omission alarms are accepted without equivalent replacement coverage. No fresh execution of this gate is credited. Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-5557/remote-html-preview-render-workspace-files-locally-over-the-file",
        "https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server",
        "https://linear.app/stably/issue/STA-4025/p1-browser-create-reports-success-when-tab-reconcile-fails-after-pr",
        "https://linear.app/stably/issue/STA-4063/p1-paired-html-preview-rejects-outside-cleanup-after-pr-13909",
        "https://linear.app/stably/issue/STA-4231/p1-owner-pinned-paired-browser-create-can-time-out-after-host-tab",
        "https://github.com/stablyai/orca/pull/14363",
        "https://github.com/stablyai/orca/pull/13876"
      ],
      "invariant": "Opening one HTML preview from a paired client renders the workspace document in exactly one client-local browser tab, located by that document and served over the orca-preview scheme. The client gains exactly that one browser workspace and it is the document one — blank where a URL page carries a URL, named by the document, with the chip naming the file — while the host gains no browser page at all, neither in its own page registry nor in the tab snapshot its clients publish into. The preview occupies its own split without taking focus from the source editor; an explicit click activates it, and closing it removes only the preview. Following a document from a file link is the other half of that switch and does move the reader to it, tab group included, whether the preview is new or already open, because opening a file is a request to look at it. A document tab quit with the client comes back as the same row on a grant the relaunched client mints afresh. A preview is named by the browser page it is open in, not by a namespace of its own, and the page registry has two halves: a workspace-document guest is registered in its own map and is absent from the browsing one entirely. That absence is the fence. Page, session and profile management, agent tab enumeration and command targeting, download routing and certificate attribution all read the browsing map directly, in more places than a per-channel guard could be remembered in, so none of them can name a document page and none of them carries a guard. Browser tools the reader drives (element grab, hover describe, selection capture, the annotation viewport bridge) are the one operation that legitimately spans the halves, and they go through the single authority that reads both, keyed by the page and its hosting renderer. The halves are disjoint in both directions: browsing registration refuses a page the document half already holds, and minting a grant refuses a page the browsing half already holds, so one id can never name a surface in both. The headless backend acts on that refusal by destroying the window it had already opened rather than leaving a policy-less page behind an id nothing can drive, keeping nothing under that id for its own shutdown to hand back. Registration refuses on the same terms when the guest it was asked about is already gone. The exit door is guarded in both its halves: a preview withdraws by revoking its grant and never through the unregister channel, so a page the document half holds arriving there is refused before either the registration teardown or the grab-state disposal beside it, which would otherwise drop the intent an in-flight preview grab compares by identity and leave that grab answering ok without ever arming its guest. A bridge request whose guest does not resolve is refused without tearing down the page it named, so a misaddressed request cannot cancel a healthy page's in-flight downloads and grabs. The annotation viewport bridge resolves its guest when its serialized op actually runs rather than when the request arrived, so a cross-process navigation while it waited cannot leave the bridge installed in a retired guest while the reader looks at a new one. State main keys by a preview's page is disposed when that page's grant is revoked, which is the only signal a preview's surface is gone. A tool asking for a page whose guest has not attached yet waits for that registration and arms when it arrives, rather than answering not-ready at the reader; that wait resolves only the request already naming this page, never the worktree-wide or any-tab waits the CLI and agents use to ask for a browser tab to drive. Handing the previewed document to the reader's own machine routes on the owners its grant was minted against — the file's own connection owner and the worktree's own runtime owner, neither read from the tab's stored fields. Only a document proven to live on this machine reaches the client OS; one with a resolved remote owner is downloaded first; and one whose owner cannot be resolved at all, workspace root included, is refused with a message naming that, because the download route would otherwise read the same absolute path on the client and hand back a same-named local file under the remote document's name. A runtime-owned path that falls outside its worktree root is refused by that route itself and surfaces as a failure toast rather than a download. Nothing the document does writes a file to this machine either: the preview partition denies downloads outright instead of routing them through the browser download flow, which has no page to attribute a preview's bytes to and would otherwise reserve a name in this desktop's Downloads folder and write them there unprompted. That refusal is visible to the reader and invisible to the document: the preview's shell carries a fixed sentence saying downloads are off, published at most once per preview per interval so a document asking in a loop cannot fill Orca's chrome, while the page itself gets back exactly what it got before, which is nothing. The sentence names no file, because the document chooses the name it offers; and a refusal never takes the document away the way an entry document's own failure does, whatever it names. A preview is a browser tab, not an editor tab in a preview mode: it is named the way a browser tab is named — by the document it shows when that document declares a title, and by the file it shows when it does not — while the chip goes on naming the file and the host whatever the document calls itself. A title is refused on the same terms the url is: a document that declares none has Chromium report the grant URL as its title, and that title is stored, mirrored onto the tab and written to disk, so anything carrying the scheme falls back to the file instead. It is created by the preview action as a page located by its document, it carries the workspace-relative path copy the editor's path header owned, and closing it revokes the grant that made the document readable while a URL tab closing beside it revokes nothing. Chrome persisted by builds that made previews editor tabs is dropped on restore rather than coming back naming a surface no restore can produce, and the ordinary editor tab for the same document is left alone. A document tab is held back at the mobile publish boundary — no client holds its grant, and the wire has no tab kind for it — while an ordinary browser tab beside it still publishes. It is held back from the group projection that publishes tab order, recency and group activity as well as from the tab list itself, so no published group names a tab the phone is never sent. A browser page can be located by a workspace document instead of a URL, and the document is the whole of its stored identity. The grant and the orca-preview URL that document is served over are minted when the page mounts and replaced by a hard reload, so neither is ever written to the page's url, mirrored onto its tab, persisted or published: such a page's url is the blank URL from creation through restore, including when a session written elsewhere carries a grant URL in, and what the session carries is the worktree and path a restored page mints afresh against today's owners. Every door onto a page's url holds that line — creation, the title update, and the navigation commit alike — so a report about a document page cannot give it a URL it never had, and the title fallback and the loading affordance follow the url each door actually wrote. The mirror carries the document too, so a tab entry cannot go on naming a document its active page has left. Every guest in the app is policy-attached through one door: a workspace document takes a restricted profile there rather than a separate installer beside it, so the attachment bookkeeping that door owns — what registration refuses, and what teardown frees — covers a preview on the same terms as a browsing page, and a preview takes none of the browsing machinery that door installs. That authority answers from the moment the embedder hands the guest over rather than only after a later navigation: the guest binds to the grant it is already showing, so the tools reach the document the reader opened and not just one they navigated to. A read the host reports as truncated or over-cap is refused rather than served partially, and a document outside the paired worktree is refused with a message naming that boundary instead of a bare read failure. The rendered document reaches nothing off-machine on its own: every served response carries a self-only content security policy, the preview session cancels any request that is not in-document, subframes cannot navigate outside the grant, a guest no document has yet bound to a grant may not navigate at all, the guest gathers no ICE candidates, and an SSH path that canonicalizes outside the grant root is refused before it is read. The one route out is a link the reader presses: a trusted click on an anchor, reported by the preview's own preload from a guest still bound to a live grant, leaves through the configured browser destination and captured source route — and only after the reader confirms the exact destination URL, so a document cannot spend a single stray press exfiltrating what it can read into a link it authored. The preview hands its guest that focus itself whenever it is the surface the reader is in — a browsing page gets it from the chrome around it, and a preview has no chrome to get it from — and it does so only then, so a preview mounted behind a terminal or an editor never takes the keyboard from what the reader is actually in. It offers again when the window itself takes focus back and nothing in the embedder has claimed that focus, because another app coming to the front lands focus on the embedder rather than the guest and the route out would otherwise stay shut until something remounted the pane — while the same window focus also arrives when the reader presses a tab, that being the guest's own blur returning, and taking focus back from there would fight the reader for their own click. Nothing else does. A navigation or popup the document starts by itself is swallowed whatever else is happening, including immediately after a genuine press elsewhere in the document, so a page that can read its grant cannot hand it to a browser tab; a middle click opens nothing; and a fragment link is answered inside the document. A preview attach carries the preview preload and no renderer-supplied one, and no other attach path can acquire it. A subresource the workspace will not send degrades the document to a notice naming that file, never to a failure panel over a page that rendered. A grant outlives neither the tab that owns it nor the renderer document that minted it, and only the trusted renderer can mint or revoke one. For the browser creations this gate still owns, owner-pinned creation returns the canonical host page identity before navigation readiness; delayed navigation cannot turn a created page into an unidentifiable failure or a duplicate retry. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback.",
      "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed. Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim. Historical prior account (preserved verbatim): Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle. Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/document-preview/doc-preview-scheme.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-preview-address-bar-convergence.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=list",
        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
        "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3",
        "npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/store/slices/browser/browser.test.ts",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
        "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
      ],
      "testFiles": [
        "src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts",
        "src/renderer/src/store/slices/browser/browser.test.ts",
        "src/main/browser/document-preview/doc-preview-grant-registry.test.ts",
        "src/main/browser/document-preview/doc-preview-file-reader.test.ts",
        "src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts",
        "src/main/browser/document-preview/doc-preview-guest-policy.test.ts",
        "src/main/browser/document-preview/doc-preview-failure-notice.test.ts",
        "src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts",
        "src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts",
        "src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts",
        "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts",
        "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
        "src/shared/document-preview/doc-preview-scheme.test.ts",
        "src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts",
        "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts",
        "src/renderer/src/components/link-actions/LinkActionPopover.test.tsx",
        "src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts",
        "src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts",
        "tests/e2e/paired-remote-html-preview-local-render.spec.ts",
        "tests/e2e/paired-preview-address-bar-convergence.spec.ts",
        "tests/e2e/paired-browser-create-navigation-deadline.spec.ts",
        "tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts",
        "src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/store/slices/browser/browser.test.ts",
          "assertions": [
            "a requested canonical page ID is stored on the page rather than reused as its workspace ID",
            "duplicate canonical page IDs are rejected before a second tab can materialize"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-html-preview-local-render.spec.ts",
          "assertions": [
            "the host's HTML document renders inside the client-local orca-preview guest",
            "neither the client browser-workspace count nor the host browser-tab count moves off baseline",
            "the preview opens in its own split with mode html-preview and leaves the source editor active",
            "an explicit click reactivates the preview, and closing it preserves the source editor, its group, and the terminal",
            "the document reports having attempted both its unattended and its post-press egress, so neither absence assertion can pass on a document that never tried",
            "a scripted window.open and location.href driven by a real press elsewhere in the document route nothing and move no browser count",
            "a real target=_blank press in the rendered document routes out as an Orca browser tab while the preview stays open"
          ]
        },
        {
          "file": "src/main/browser/document-preview/doc-preview-file-reader.test.ts",
          "assertions": [
            "reads a document too large for one reply by range under the same grant",
            "refuses a document rewritten between ranges instead of splicing versions",
            "requires approval for a sibling directory before touching the runtime"
          ]
        },
        {
          "file": "src/main/browser/document-preview/doc-preview-grant-registry.test.ts",
          "assertions": [
            "keeps silent authority over a document directory strictly inside the workspace, and only there",
            "uses Windows semantics when authorizing a sibling directory",
            "keeps an approved SSH directory inside the canonical workspace boundary"
          ]
        },
        {
          "file": "src/main/browser/document-preview/doc-preview-failure-notice.test.ts",
          "assertions": ["413 and 415 map to distinct reasons and everything else stays generic"]
        },
        {
          "file": "src/main/browser/document-preview/doc-preview-guest-policy.test.ts",
          "assertions": [
            "never rebinds a bound guest onto a second grant",
            "leaves a re-minted preview registered when the guest it replaced tears down"
          ]
        },
        {
          "file": "src/shared/document-preview/doc-preview-scheme.test.ts",
          "assertions": [
            "malformed grant ids and unsupported schemes are refused",
            "undecodable percent escapes are refused"
          ]
        },
        {
          "file": "src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts",
          "assertions": [
            "a document page's url is blank in the store, in the written session and after restore",
            "a document navigation report leaves its URL blank, its title standing and nothing loading; its session excludes preview URLs"
          ]
        },
        {
          "file": "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx",
          "assertions": [
            "a preview that is the reader's surface hands its guest focus, and one that is not leaves focus alone",
            "the window taking focus back re-offers it to the guest, and re-offers nothing for a preview that was refusing"
          ]
        },
        {
          "file": "tests/e2e/paired-browser-create-navigation-deadline.spec.ts",
          "assertions": [
            "a held navigation exceeds the former create deadline while the first RPC returns the exact authoritative host page ID",
            "host inventory contains exactly one new page and the user retry branch is never entered"
          ]
        },
        {
          "file": "tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts",
          "assertions": [
            "the exact created page exists on the host while publication is held and no browser tab materializes on the client",
            "a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split",
            "a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories",
            "headed and headless hosts preserve the unrelated editor and terminal without local fallback"
          ]
        },
        {
          "file": "src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
          "assertions": [
            "replays a snapshot that beat the RPC response and focuses the exact adopted leaf",
            "retains exact-leaf focus intent when a split sibling publishes first"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 186,
          "summary": "The rewritten journey passed 2/2. The first test proves the inverted claim: the client gains exactly one browser workspace and it is the document one — page and tab url blank, the document path mirrored onto both, the tab named by the document's own title, the chip still naming the file, no editor row of the retired preview species — while the host's page registry and tab snapshot both stay at their pre-action content. Both host oracles carry a presence precondition in the same run: an ordinary URL browser tab this client opens does arrive in browser.tabList and in session.tabs.list, and leaves both again when it is closed, so the preview's absence is a decision rather than an oracle that cannot see browser pages. The document still reaches nothing on its own (zero ICE candidates, unattended and post-press egress both swallowed), and the one route out still works: a real press on a target=_blank anchor routes exactly one call and opens a tab while the preview stays open. The second test quits the client with a document tab open and relaunches it on the same profile: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "failed",
          "durationSeconds": 108,
          "summary": "Candidate with the sole delta that the preview action also opens an ordinary browser tab through the runtime — what it did before STA-5557 — failed at the client-workspace count, 2 against the 1 the claim allows. It dies there rather than at the host oracle, so it proves the exactly-one-workspace half; the host half has no single line to mutate, since a document page never calls the runtime at all, and is protected instead by the presence precondition recorded above.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "failed",
          "durationSeconds": 190,
          "summary": "Candidate with the sole delta that the workspace row stops mirroring the document its active page shows failed in both tests on workspaceDocFilePath, null against the document path — the tab entry would go on naming nothing while the page it renders is a document. Two earlier mutants survived and are reported as ill-posed rather than as blind spots: flipping the mobile publish filter changes what this desktop publishes to its own phone clients, not what a paired client puts on its host, and flipping the document mirror in the workspace constructor is repaired on the next state write by the active-page mirror, which is the line the mutant above hits.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "failed",
          "durationSeconds": 195,
          "summary": "Candidate with the sole delta that the preview pane does not hand focus to its guest — the tree as it stood before this change — failed at the target=_blank press: six real presses reached the anchor, the embedder had the webview as its active element, and main's own log answered each report with registered true, grant live, focused false. This is the gap the rewrite found: since previews became browser pages they had no chrome to pass focus on, so the one route out of a preview was shut.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/lib/file-preview.test.ts",
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "durationSeconds": 22.09,
          "summary": "29/29 on the candidate that makes the preview a browser tab. The preview action now creates a page located by the document; reopening the same document activates the tab it is already in rather than minting a second grant on one file; and closing that tab revokes its grant, which nothing else does now that the editor tab's close hook is gone. Red-green with each mutant as the sole delta: dropping the reuse lookup opens a second tab for a document already on screen, and dropping the release on close leaves the document readable through a grant nothing revokes until the process ends. Both are paired with presence preconditions in the same runs — a second, different document still gets its own tab, and a URL tab closed beside the document tab revokes nothing, so a release fired for every close would fail rather than pass. Historical command preserved after removal of the mocked preview test suite in the test-value audit; currentCommand links only the remaining suites. The recorded result, count, duration and mutation narrative describe the historical command. The current command has not been rerun here and does not claim equivalent coverage."
        },
        {
          "date": "2026-08-27",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts",
          "result": "passed",
          "durationSeconds": 1.54,
          "summary": "10/10 on the candidate that gives a browser page a workspace-document location. The trap this is built around: page.url is read by persistence, the mobile publisher, history and the address bar, so a grant URL parked there would outlive the grant that named it and travel to readers that cannot resolve it. Creation overrides the url rather than trusting its caller, and restore re-asserts the same thing, so a session written by another build cannot carry one in. Red-green with each mutant as the sole delta: dropping the creation override writes the grant URL into the store and into the session payload; dropping the restore override brings a foreign session's grant URL back; leaving docLocation out of either browser schema strips it on load and restores the document as a blank New Tab under a strip entry that still names it (both schemas are plain z.object, and this is the trap that already cost one round on the editor schema); dropping it from the workspace build or the mirror leaves the tab entry naming a document its page has left, which the publish boundary reads; dropping the salvage-path copy loses the document when only the tab row survived; and dropping the address-bar exclusion focuses an address bar the surface does not have. The blank-url assertions are paired with a presence precondition in the same run: an ordinary tab created through the same call keeps its URL and does ask for the address bar.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 23.1,
          "summary": "The journey passed 1/1 on the candidate that requires the guest to be bound to a grant before any navigation is allowed, rather than admitting an unbound one. The document still rendered and the target=_blank press still routed out, which is the half that would break if the renderer-set src reached will-navigate: it does not, because that load is browser-initiated, so the permissive branch it was written for is unreachable.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-26",
          "runner": "ci",
          "platform": "linux",
          "command": "npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1",
          "result": "failed",
          "durationSeconds": 72,
          "summary": "The journey failed on Ubuntu at the post-press presence precondition, with #post-input-egress still reading 'idle' after 30 seconds. The trace shows the press was dispatched at 769.5,143.9, a point the guest's own hit test had just confirmed was on its heading, and the focus report before it was already isFocused true, so neither focus nor coordinates were the break: the press never entered the guest at all. A standalone Electron 43 probe under Xvfb with this suite's Linux flags reproduced it in roughly two runs in five when pressing immediately after guest attach — the embedder received the pointerdown with the webview element as its target, meaning the browser resolved the press against the embedder because the freshly attached guest had not yet registered its hit-test region. The same probe never dropped a press on macOS, which is why local runs of either project could not see this. The spec now presses until the document answers, mirroring the target=_blank phase.",
          "currentCommand": "npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3",
          "result": "passed",
          "durationSeconds": 72,
          "summary": "The journey passed 3/3 on the trusted-click candidate, which removed the recent-input gate, made both navigation sinks deny-only, dropped the webview's allowpopups attribute and gave the preview guest its own pinned preload. The fixture now also attempts a window.open and location.href from inside a pointerdown handler, so the egress rides a press the reader really made: it reported 'attempted' every run while both browser counts stayed at that phase's baseline and nothing routed, and the later real press on the target=_blank link still opened exactly one Orca browser tab with the preview still open.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "failed",
          "durationSeconds": 26.9,
          "summary": "Candidate with the sole delta that the navigation sinks route again behind a two-second recent-input gate failed on clientBrowserWorkspaceCountAllWorktrees 1 versus baseline 0: the document's location.href, run from inside the handler for the reader's press on the heading, opened a real browser tab. That is the case the earlier design could not distinguish from the press's own effect, and it is why the sinks route nothing at all now. The same run still refused the unattended on-load egress, so this measures the new half specifically.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 22.8,
          "summary": "The journey passed 1/1 with the fixture document now attempting its own egress on every load: an unattended window.open and location.href to an off-machine URL, and an ICE gathering probe. Both browser counts held at baseline and the probe reported candidates=0, while the document still rendered and the later real target=_blank press still routed out as an Orca browser tab.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "failed",
          "durationSeconds": 23.6,
          "summary": "Candidate with the sole delta that the preview guest no longer receives the disable_non_proxied_udp IP-handling policy failed on candidates=6 versus 0, proving the document can gather ICE — including a STUN reflexive candidate against an off-machine server in the standalone probe — whenever that one main-process call is missing.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3",
          "result": "passed",
          "durationSeconds": 66,
          "summary": "The journey passed 3/3 again under --repeat-each=3 on the candidate that clears grants on every fresh shell document and gates the mint channel on the trusted renderer, so neither change disturbs a live preview: the document still rendered, both browser counts held at baseline, and the target=_blank press still routed out as an Orca browser tab.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3"
        },
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3",
          "result": "passed",
          "durationSeconds": 59.7,
          "summary": "The renamed journey passed 3/3 under --repeat-each=3 on the hardened candidate: the host document rendered in the orca-preview guest, both browser counts held at baseline through the split, focus, reactivation and close phases, and the final phase's real target=_blank press routed out as an Orca browser tab with the routing call recorded as opened while the preview tab stayed open.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3"
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 18.3,
          "summary": "The full headed spec passed 2/2. A visible desktop host and separate paired Electron client proved both reconciliation rollback and capability rejection with a failure toast and exact host/client browser, group, editor, and terminal inventory restoration.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 9.1,
          "summary": "The full isolated headless-serve journey passed 1/1, applying both reconciliation and capability faults to the same live host while preserving the visible-toast and exact inventory-restoration oracle.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 24.3,
          "summary": "A visible desktop host and separate paired Electron client held one exact host page before client materialization, forced the post-create timeout, then proved exact host rollback, empty-split removal, failure UI, no local fallback, and surviving editor and terminal.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 18.5,
          "summary": "The same exact-page hold, timeout, rollback, client cleanup, no-fallback, editor, and terminal oracle passed against isolated headless serve.",
          "currentCommand": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-08-13",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 18.1,
          "summary": "Two isolated headed Electron/CDP journeys passed: the direct owner-pinned call returned one canonical host ID before held navigation, and the real remote-pane context-menu route materialized that one page without retry or duplicate.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1412; any retained unchanged-source receipts apply only to their own commands. Historical account: Audit1386 changed selectors have no new soak result. Historical account: Changed selectors have no new soak result after Audit1308; any retained unchanged-source receipts apply only to their own commands. Historical account: The candidate passed isolated local macOS Electron runs before and after the final rebase; longer CI and soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1412 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1386 changed test sources; no new red/green validation of reduced selectors. Historical account: Audit1308 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The unchanged STA-4063 five-assertion oracle is red 5/5 on scan e4c278eb52 and latest main bc2e30000b, partially green 2/5 on pre-fix PR #14100, green 5/5 on candidate 14b5877a75, and red 3/5 when only the new transaction cleanup boundary is disabled on final candidate a9e6fb7716. The earlier STA-4025 transaction oracle remains red on the post-#13909 base and green on this candidate. The byte-identical STA-4231 headed oracle is red on latest-main b19d99bd00: both 15-second creates return runtime_timeout without a page ID while the host retains two distinct pages after retry. The relevant behavior is unchanged through 0a0ae974d4. The candidate is green with one returned canonical ID, one host/client page, and no retry; disabling only the navigation-independent acknowledgement is red with the same two orphaned pages. The byte-identical 2ec1dcf1 Electron oracle remains red on latest main 346e59c879, green on candidate d05217c40d, and red with only side-preview focus disabled; historical 5806b23f evidence separately proves owning-runtime routing. For the STA-5557 preview behavior the rewritten journey is green 1/1 on the candidate and red when the sole delta makes the same preview action also create a browser tab, failing on clientBrowserWorkspaceCount 1 versus baseline 0. That absence assertion is gated on first reading the rendered document out of the guest, so it cannot pass by the preview never happening. Against pre-STA-5557 builds the journey is red by construction rather than by measurement: those builds have no html-preview tab mode, so the run would fail earlier, at materialization, and it has not been executed against an old build. The reader-facing half is red-green at the unit layer. The 6/6 green and 2/6 red pair recorded earlier on 2026-08-26 measured the superseded shape, where a subresource failure was filtered out entirely; the shipping shape is green 10/10 and red 3/10 when the sole delta makes every failure, asset or entry, set the blocking reason. The containment lines the second review found uncovered are red-green too: installing the scheme handler on the default session instead of the preview session, and widening the scheme privileges with allowServiceWorkers and bypassCSP, each fail the protocol suite as the sole delta, and deleting the html-preview case from the closed-tab cleanup fails the hook suite. The external-link phase added on 2026-08-26 is red-green by measurement: green 3/3 on the trusted-click design, in which the guest's own preload reports a trusted press on an anchor and main answers only a focused preview guest holding a live grant. Its earlier shape depended on the webview carrying allowpopups and went red with zero recorded routing calls when only that attribute was dropped; the preload now intercepts the press before Chromium considers a popup, so the attribute is gone and that measurement retired with it. One further run failed in the paired-client harness before reaching any preview step, when the client window never exposed its store within the launch timeout; that is a harness flake, not a preview signal. The two egress fences added on 2026-08-26 are red-green by measurement in the same journey, whose fixture attempts its own escape on every load and again from inside the handler for the reader's press on the heading: with deny-only navigation sinks the document opens no browser tab and the counts hold at baseline, and with the sole delta that those sinks route again behind a two-second recent-input gate the post-press location.href opens a real tab, clientBrowserWorkspaceCountAllWorktrees 1 against a baseline of 0. An earlier measurement of that same gate, taken when it was the shipping design, showed the unattended on-load egress opening two tabs once the gate was removed entirely; it was retired with the gate, because a gate that cannot tell a script's navigation from the click it followed was never the fence the claim needed. With the guest's IP-handling policy the document reports candidates=0, and with the sole delta that the policy call is removed it reports candidates=6. Both mutants were applied to the shipping module, rebuilt, and run against the live paired journey rather than reasoned about."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical prior-selector budget; changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. The transaction adds no timer, polling, retry, subprocess, RPC method, stream opcode, or global host publication. Owner-pinned success performs one create RPC followed by one asynchronous goto, retains one page, and performs zero retry or cleanup calls. A lost create acknowledgement performs one exact close by the preallocated canonical ID and at most one confirming snapshot. Headless goto publishes one worktree-scoped session snapshot after navigation. Capability rejection performs zero RPCs and one bounded empty-group close. The E2E-only one-shot faults are build-gated, retain one promise/flag and a bounded page-id set, and reset after each run. Pending client placements remain capped at 128 and clear on adoption, failure, or teardown."
      },
      "promotionCriteria": [
        "Collect Linux and physical Windows paired-server evidence.",
        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
      ],
      "knownGaps": [
        "Audit2643 deletes the seven fake-manager browser IPC cases: renderer-owned registration repair, untrusted download cancellation refusal, exact certificate approval, cancelled pending grab enablement, in-flight grab serialization, stale guest registration waits, and annotation ownership refusal. These alarms are intentionally lost without replacement; dated evidence retains its original scope and no fresh gate execution is claimed.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged.",
        "Audit1568 removes API inventories, supplied mock-value/forwarding assertions, implementation-shape tables and negative/setup cases that do not reach their intended boundary, without equivalent replacement claims. Retained changed definitions exercise owned manager lifetime/queue/refcount/clamp and real synthetic process/files/staging boundaries. Seventeen unchanged native Electron definitions across this combined audit are statically reviewed and not rerun. Changed native suites exercise local popup wire/cookie/session and clean/native process-identity behavior; known popup-admission flaws remain unfixed. Unit native/event/session/registry inputs remain injected. No actual OS focus, registry/host execution, CRX verification or durable restart proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged.",
        "Audit1564 retires copied cookie key recipes, mock bridge/preview forwarding and flag tables, source-spelling/script inventories and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise actual scoped SQLite merge/rollback/schema refusal, owned cancellation and grant authority/canonical containment, ranged response consistency, replacement guest ownership and executed guest-script promise/DOM cleanup behavior. Session, host response, geometry/observer and transport producers remain injected where documented. One unchanged native extension definition is not rerun locally; no actual remote filesystem, native layout/focus or authentication claim. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged.",
        "The standalone download-notice throttle suite was removed; its interval, per-grant, revocation-reset and unbound-guest alarms are intentionally lost. Remaining notice suites are not claimed as exact substitutes.",
        "Historical receipt before standalone test removal, preserved with its originally executed command; remaining commands were not rerun for this audit: {\"date\":\"2026-08-27\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/doc-preview-download-block-notice.test.ts src/main/browser/browser-session-partition-policies.test.ts src/main/browser/doc-preview-guest-policy.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\",\"result\":\"passed\",\"durationSeconds\":1.78,\"summary\":\"64/64 on the visible download refusal, re-issued at the relocated path. This replaces the 2026-08-27 record of the same four files at 62/62, whose ten mutants — removing the notice from the deny listener, adding it to the routing listener, dropping the guest-registry lookup that names which preview to tell, dropping the shell branch and the row, letting the row survive the failure panel, removing the per-preview throttle, sharing one throttle across previews, never expiring the window, and publishing for a contents no preview is bound to — all failed as sole deltas. The relocation moved no line of any of them.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-download-block-notice.test.ts src/main/browser/sessions/browser-session-partition-policies.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\"}",
        "Live paired-server validation currently covers macOS only.",
        "Multiple simultaneous viewers are not exercised by the Electron journey.",
        "Local workspaces intentionally keep the embedded browser tab at a file URL and are not covered by the preview journey.",
        "The SSH preview owner has unit coverage only; no live SSH host renders a preview in this gate.",
        "The preview journey exercises one self-contained document. Relative subresources, reload re-reading the workspace disk, and the truncated and out-of-worktree refusals are covered by unit contracts only.",
        "Renderer close-to-release mock ledgers were removed; the live journey observes tab disappearance without inspecting main grant registry revocation.",
        "The external-link route trusts a real press on an anchor in a focused preview guest, so it proves the reader pressed that anchor, not that the anchor's visible text matches its target. The tab it opens is visible, which is the remaining containment.",
        "WebRTC is fenced by the IP-handling policy rather than by removing the API; the guest can still construct a peer connection, and the journey measures that it gathers nothing.",
        "The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical.",
        "The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent.",
        "The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged.",
        "The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite.",
        "Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1308 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/browser-preview-tool-authorization.test.ts src/main/browser/browser-manager-annotation-bridge.test.ts src/main/browser/browser-manager-guest-lifecycle.test.ts src/main/browser/offscreen-browser-backend-lifecycle.test.ts src/main/browser/doc-preview-guest-policy.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/editor/EditorPanelShell.header.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.52,\n          \"summary\": \"174/174 at the relocated paths, replacing the 2026-08-27 records of the same command at 162/162 and 158/158. Those established, as sole deltas: removing the unregister-channel refusal goes red because the grab disposal beside it drops the intent an in-flight preview grab compares by identity, while an ordinary browser page driven through the identical sequence still has its grab state disposed; removing registration’s already-gone-guest refusal goes red for both a missing and a destroyed guest; removing the map deletion on the refusal path goes red at shutdown; the bridge’s own unregisterGuest branch, restored, tears down a live page over a misaddressed request; and the download fall-through for an unresolved owner hands back a same-named local file under a remote document’s name.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/browser/browser-preview-tool-authorization.test.ts src/main/browser/guest-lifecycle/manager/browser-manager-annotation-bridge.test.ts src/main/browser/guest-lifecycle/manager/browser-manager-guest-lifecycle.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/editor/EditorPanelShell.header.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\"\n        }",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/runtime/web-runtime-session.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser.test.ts\",\"result\":\"passed\",\"durationSeconds\":10.83,\"summary\":\"Five post-review host, IPC, store, and client lifecycle files passed 1,356 tests with one pre-existing skip, including both shards that failed before the canonical page/workspace identity and typed missing-page cleanup corrections.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed.",
        "Audit1386 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/doc-preview-grant-registry.test.ts src/main/browser/doc-preview-file-reader.test.ts src/main/browser/doc-preview-protocol.test.ts src/main/browser/doc-preview-guest-policy.test.ts src/main/browser/doc-preview-failure-notice.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/lib/doc-preview-grants.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/lib/file-preview-action-visibility.test.tsx src/main/window/main-window-webview-security.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts\",\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.63,\n          \"summary\": \"189/189 over the grant, reader, protocol, guest-policy, scheme-admission, plan-routing, action-visibility, failure-message, external-link and terminal-row contracts. This replaces the 2026-08-27 record of the same command at 174/174, whose thirteenth file was the deleted doc-preview-external-link-bridge.test.ts: the STA-5758 hardening moved that behavior into the reader-facing confirmation (doc-preview-external-link-confirmation.test.ts), which now proves the exact destination is shown and nothing opens on cancel, alongside everything the retired run carried — the stale-mint rejection that must not evict a reopened preview tab, the CSP header and session request filter, the SSH symlink refusal, subframe containment, truncated and over-cap reads, the unservable-asset and empty-file split, the out-of-worktree paired refusal, and the guest deny-only navigation sinks. The count also carries the entry-only rule added on top of the hardening: a grant whose document directory is its own request base — a workspace-root or out-of-workspace document — reads nothing but the entry file until the reader approves a directory, at both the lexical and the canonical containment pass, because that directory is where secrets live and a DNS-prefetch beacon needs no click. Historical command preserved after removal of the mocked preview test suite in the test-value audit; currentCommand links only the remaining suites. The recorded result, count, duration and mutation narrative describe the historical command. The current command has not been rerun here and does not claim equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-protocol.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/lib/doc-preview-grants.test.ts src/main/window/main-window-webview-security.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts\"\n        }",
        "Audit1386 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"remote-runtime\"]}. Static assertion references are not current execution evidence.",
        "Audit1386 historical assertion inventory for changed sources:\n[\n  {\n    \"file\": \"src/renderer/src/lib/doc-preview-grants.test.ts\",\n    \"assertions\": [\n      \"grants are deduped per preview tab so a StrictMode double-mount cannot revoke the surviving webview\",\n      \"a mint that rejects after its tab was released and reopened leaves the reopened tab's grant revocable\"\n    ]\n  }\n]",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1412: src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed.",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/browser-preview-tool-authorization.test.ts src/main/ipc/browser-tab-registration-wait.test.ts src/main/ipc/doc-preview-grant-ipc.test.ts src/main/browser/browser-manager-guest-lifecycle.test.ts src/main/browser/browser-manager-guest-policy-profile.test.ts src/main/browser/browser-manager-annotation-bridge.test.ts src/main/browser/offscreen-browser-backend-lifecycle.test.ts src/main/browser/doc-preview-guest-policy.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.5,\n          \"summary\": \"175/175 at the relocated paths on the unified tool authority, replacing the 2026-08-27 record of the same command at 174/174. That run killed twelve of fourteen mutants as sole deltas — dropping the document branch from the one authority door, removing either browsing-registration refusal or the mint-side refusal that is its converse, deleting the registration notification or widening it to the worktree-wide and any-tab waits, disposing revoked state by grant instead of by page, dropping the hosting-renderer or destroyed-contents check, rebuilding the renderer tool target from the grant, and deleting the teardown identity check under a re-mint — and reported two as ill-posed rather than as kills. The relocation changed no file it names except their directory.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/browser/browser-preview-tool-authorization.test.ts src/main/ipc/browser/browser-tab-registration-wait.test.ts src/main/ipc/doc-preview-grant-ipc.test.ts src/main/browser/guest-lifecycle/manager/browser-manager-guest-lifecycle.test.ts src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts src/main/browser/guest-lifecycle/manager/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\"\n        }",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-manager-guest-policy-profile.test.ts src/main/window/main-window-webview-security.test.ts src/main/browser/doc-preview-guest-policy.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.32,\n          \"summary\": \"55/55 on the candidate that gives every guest one attach door. A preview used to reach its policies through an installer of its own, which meant the manager's attachment bookkeeping — the set registration consults and the cleanup teardown runs — never knew a preview existed. It is now a profile on `attachGuestPolicies`, and the doc policy is what that profile installs. Red-green with each mutant as the sole delta: deleting the profile branch hands a previewed document the browsing machinery (clicked-link routing, frame routing, popup child windows, anti-detection over the debugger) and lets it navigate off-grant; dropping the manager's destroyed wiring leaves the guest answerable through the grant-keyed authority after it dies and its id marked attached forever; and making the window fork ask for the default profile is caught at the fork itself. The absence assertions are paired with a presence precondition in the same run: a browsing guest attached through the same method observably takes every one of those things, so a profile that fenced nothing, or an attach path that had stopped installing anything at all, fails rather than passing empty.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts src/main/window/main-window-webview-security.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\"\n        }",
        "Audit1412 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1421 removes browser-address-bar-suggestions.test.ts. Document suggestion title/path matching, recency merging and path-prefix ranking alarms are lost. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; the reduced command has no new execution result.",
        "Audit1803 retires this complete dated receipt because doc-preview-scheme.test.ts was reduced. It does not validate the reduced selector. Original receipt verbatim: {\"date\":\"2026-08-27\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/doc-preview-scheme.test.ts\",\"result\":\"passed\",\"durationSeconds\":2.05,\"summary\":\"39/39 on the title-parity trio at the relocated path, replacing the 2026-08-27 record of the same three files, which killed five mutants as sole deltas: disabling the document branch restores New Tab for a named document, dropping the grant-URL refusal puts the scheme into the title, the tab mirror and the written session, returning New Tab instead of the file name breaks the fallback, removing the guest listener leaves the document unable to name its tab, and making the scheme test parse rather than prefix-match lets a title that merely looks like a preview URL through.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/doc-preview-scheme.test.ts\"}",
        "Audit1853 retires this complete dated receipt because its selector includes reduced test sources. Its historical result, count and duration do not validate the reduced selector or equivalent coverage. Original receipt verbatim:\n{\n          \"date\": \"2026-09-06\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/doc-preview-grant-ipc.test.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/store/slices/tabs-hydration.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.12,\n          \"summary\": \"44/44 across all four files after PR #19130 moved the terminal popover suite to the shared LinkActionPopover path; all eight popover cases remain. This replaces the 2026-08-27 command that named the removed test path. Historical evidence from that run (4.77 seconds; mutation checks were not repeated in this rerun): 40/40 on the candidate that removes the editor preview species and moves its two boundary duties onto the browser tab. The publish filter moved with the tab: it used to exclude an editor file by mode, and now excludes a browser workspace by whether it is located by a document — asserted at both the group projection and the tab loop, because a mutant that filters only one of them still publishes. Migration is the other half: sessions written by builds that made previews editor tabs carry chrome whose entity id encodes the document, and whose document was never persisted, so it has always come back naming a surface no restore produces; that chrome is now dropped. Each mutant as the sole delta: filtering neither place publishes the document tab to mobile, filtering only the projection still publishes it, and removing the migration leaves the stale strip entry. Presence preconditions in the same runs: an ordinary browser tab beside the document tab does publish, and the ordinary editor tab for the very same document survives hydration. Historical command and result are preserved after the test-value audit removed the tab-store assertions this run included. currentCommand is only an administrative link to the remaining gate command; the historical run has not validated that command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/doc-preview-grant-ipc.test.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts\"\n        }",
        "Audit1853 accepts removal of the LinkActionPopover resolved-file-path copy/open-state alarm and Settings callback-order/explicit-omission alarms. The surviving clipboard pending-write and failure-retry cases do not establish equivalent coverage; fake clipboard/toast/popover boundaries do not prove native clipboard or settings navigation. Surviving command and test-file selectors remain.",
        "Audit1899 replays sealed Audit1895: workspace-doc-history.test.ts is entirely removed from its current command and testFiles. Supplied recency/dedupe/cap/title/identity examples and the10000-row getter-read budget alarm are intentionally lost. No current assertionRef or active receipt selects that file. Unrelated active receipts and all prior gap literals remain verbatim; no replacement history/index-work coverage or new browser/paired-preview gate execution is claimed.",
        "Audit1925 (sources1922/1923): The complete terminal-file-link-actions suite is removed. Lose supplied local/remote menu-row inventories, browser label/order/download/reveal callback forwarding, platform-copy and source-group pinning examples. No OS reveal/download, real remote preview or browser navigation was exercised; the other real document-preview sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'offers Orca and system-default actions for a local file'; 'offers a local HTML file the link-routing browsers, primary first'; 'labels workspace switching and omits an impossible remote alternate'; 'offers the same rows for a remote previewable file, downloading before the OS opens it'; 'keeps row parity between local and remote previewable files'; 'drops the remote download row for a path that announces itself as a directory'; 'offers Reveal in Finder for a local file link and reveals it through the shared path'; 'selects a folder link in its parent instead of opening it'; 'uses the platform file manager name'; 'omits the row for a workspace-root link, which has its own Open in Finder row'; 'omits the row for a file owned by an SSH or runtime host'; 'omits the row when the pane shell runs on %s'; 'keeps the row for a local link while a server is focused, and omits it for a runtime-owned link'; 'reveals nothing until the row is clicked'; 'pins the source group with groups $groupIds'; 'omits the row for an unknown source or a workspace switch'.",
        "Audit1973: Delete the browser RPC forwarding/schema/scalar suite and its prospective selector. Preserve all27 unrelated dated receipts; no actual browser operation alarm is replaced. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1973 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser/browser.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts\"",
        "Audit1973 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/browser/browser.test.ts\"",
        "Audit2043: Remove the registration-wait, webview-security, preview-authorization, guest-lifecycle and grant-IPC unit suites and the sibling-directory assertion reference. Runtime and browser capability consumers also lose removed imported examples. Remaining document-policy, file-reader and grant-registry assertions do not replace those alarms. Preserve the 27 independent dated receipts at their original unchanged selectors; reduced prospective unit selectors have no fresh result or equivalent replacement claim.",
        "Audit2043 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n          \"assertions\": [\n            \"keeps silent authority over a document directory strictly inside the workspace, and only there\",\n            \"authorizes only the requested sibling directory\",\n            \"uses Windows semantics when authorizing a sibling directory\",\n            \"keeps an approved SSH directory inside the canonical workspace boundary\"\n          ]\n        }",
        "Audit2043 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/main/window/main-window-webview-security.test.ts\",\n          \"assertions\": [\n            \"an orca-preview src is admitted only on the preview partition with a live grant\",\n            \"preview guests receive their own policy instead of the browser guest policies\",\n            \"a preview attach is pinned to the preview preload over any renderer-supplied value, and a browsing attach never receives it\",\n            \"grants a renderer can no longer release are cleared at window creation and on reload, and survive an in-document navigation\"\n          ]\n        }",
        "Audit2043 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence:\n{\n          \"file\": \"src/main/ipc/doc-preview-grant-ipc.test.ts\",\n          \"assertions\": [\n            \"a sender that is not the trusted renderer mints no grant and revokes none\",\n            \"a reported link click reaches the guest policy with its own sender, and a non-string report reaches nothing\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "D01 candidate audit retires this complete dated receipt because a named test source changes in the candidate overlay. It supplies no new execution or equivalent-coverage claim. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 1.27,\n          \"summary\": \"Candidate with the sole delta that every failure sets the blocking reason, asset or not, failed 4/14 on the asset-notice assertions — the same mutant the retired 2026-08-26 record measured at 3/10, re-run at the relocated path. A refused subresource must name itself over a document that stays mounted; only the entry document may take the page away.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\"\n        }",
        "D01 candidate audit retires this complete dated receipt because a named test source changes in the candidate overlay. It supplies no new execution or equivalent-coverage claim. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.54,\n          \"summary\": \"14/14 on the reader-facing failure suite at its relocated path. This and the red run below replace the 2026-08-26 pair recorded against the pre-relocation path (10/10 green, 3/10 red), re-measured today so the entry/subresource split keeps a red half rather than only a green one.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\"\n        }",
        "D01 final candidate whole-registration policy removes retired module selectors and obsolete assertion descriptions prospectively. Existing unaffected receipts retain their original scope; reduced selectors have no new execution or equivalent replacement claim. Retired named modules: [\"src/preload/doc-preview-link-interception.test.ts\",\"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx\"]. Retired compound assertion refs, preserved as historical data: [{\"file\":\"src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\"assertions\":[\"an external preview link shows the reader its exact destination and becomes a browser tab only after confirmation\",\"a declined confirmation opens nothing, and a confirmed tab that is refused or fails outright surfaces instead of being dropped\"]}]",
        "Audit2452 removes the whole fake-effect browser-close routing suite. Active selectors and assertion references no longer select it. Its requested-worktree default close, sibling-page close and explicit missing-page typed reply alarms are intentionally retired without equivalent replacement. Prior dated receipts remain unchanged and scoped to their original sources; no fresh execution of the reduced gate, rendered browser, live remote, mobile or cross-platform validation is claimed. Retired assertion reference: {\"file\":\"src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts\",\"assertions\":[\"closing an absent renderer page returns browser_tab_not_found instead of an untyped failure\"]}",
        "Audit3108: doc-preview-grants.test.ts now retains only the stale grant-rejection race: a late rejected grant request must not evict a newer grant registry entry, witnessed by later revocation of grant-2. Retire stable minted-location and outside-workspace POSIX/Windows request-projection alarms without replacement. The direct nonempty grant selector remains unchanged; no real grant-server/file authorization, SSH/HTML delivery or native-focus result is claimed.",
        "File/document owner layout retires the complete workspace-doc-address-input unit suite because its sole mixed case asserts internal catalog-enumeration work. The current-workspace HTML-resolution alarm is lost; no equivalent replacement coverage or pass for the reduced unit selector is claimed. Historical receipts and all remaining selectors/assertions retain their original scope.",
        "Module-layout wave2 intentionally retires complete prohibited owning registrations in src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts. Lost alarms: A resolved remote file owner taking precedence over an unresolved workspace owner would lose its routing alarm. A project published on two hosts refusing to open an ambiguous local copy would lose its refusal alarm. An unresolved document refusing both local open and remote download, and including its path in the refusal, would lose the existing alarm. An unknown workspace root preventing an accidental local document open would lose its guard alarm. A restored document using its recorded runtime owner when the worktree resolves none would lose its existing fallback alarm. A restored tab without a recorded owner consulting the resolved worktree owner would lose its existing fallback alarm. No equivalent replacement coverage or reduced-selector pass is claimed.",
        "Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof.",
        "Audit3335 retires the complete three-case browser-tabs snapshot assembly suite: canonical snapshot replay/placement/focus, local host-page adoption and unstamped host echo leaving a local page untouched alarms are intentionally lost without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/network, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3342 retires the complete mobile editor/diff tab-publication projection suite: editor/diff serialization, workspace-document privacy withholding, pending/focus and capability/options projections are intentionally lost without equivalent replacement. The surviving focused selectors are unexecuted in this source composition. Six complete compound macOS receipts whose command fields select the changed source are retired verbatim as history; their other selected tests receive no promoted evidence. Other dated receipts keep their original scope; no fresh runtime/UI/mobile/mixed-version or cross-platform validation is claimed.",
        "Audit3342 historical original commands object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\"",
        "Audit3342 historical original commands object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts\"",
        "Audit3342 historical original testFiles object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n\"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts\"",
        "Audit3342 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts\",\n          \"assertions\": [\n            \"keeps a workspace document out of published tab groups as well as the tab list\"\n          ]\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 7,\n          \"summary\": \"The adversarial pass answered the request for its own group-projection probe after this round landed, and it had measured a third observable this test was missing: the held-back group also has to leave the published layout tree, or the phone renders a split whose second pane can never hold anything. Adopted as a fourth assertion and re-run against the same sole delta, which now fails on the dangling-reference check and, with that check blinded, on the layout alone — group-left and group-right against the group-right the clean tree publishes. The two probes agreed on everything else, including that the tab list is unchanged under this mutant, which is why an assertion reading only the tab list cannot reach the site at all.\"\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"The adversarial pass's four coverage findings, landed and pinned: 58/58. The third url door now keeps a document page blank and names it by its document, the group projection holds a document back from published groups as well as from the tab list, the pane's focus handoff is pinned in the widening direction as well as the narrowing one, and the handoff is re-offered when the window takes focus back.\"\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"Three sole-delta mutants on the third url door, each failing only the new store test: committing the reported url onto a document page, dropping the document from the title normalizer there (which renames the tab New Tab, since a blank url is what that fallback reads), and marking a blank document page loading. The ordinary-page half of the same test passes under all three, so the door is pinned as a document-only refusal rather than as a door that writes nothing.\"\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"Two sole-delta mutants on the mobile publish boundary. Dropping the document from the group projection's browser ids fails only the new grouped test — the tab list stays correct because the per-tab guard still refuses the tab, and what breaks is a published group whose order and active tab name a tab the phone is never sent. This is the survivor the adversarial pass reported: it survives the whole suite without this test, because no other test in it has tab groups. Dropping the per-tab guard instead fails only the ungrouped test, so the two halves of the boundary are pinned separately.\"\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"Three sole-delta mutants widening the focus handoff, the direction the adversarial pass found uncovered: dropping the page-activity half, dropping the active-tab-type half, and dropping the active-browser-tab half each fail exactly one of the pane's refusals — the inactive page, the terminal in front, and the other browser tab respectively. The presence half of that test passes under all three, so a pane that had stopped offering focus at all would still fail rather than pass the refusals vacuously.\"\n        }",
        "Audit3342 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-editor-diff-tabs.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3,\n          \"summary\": \"One sole-delta mutant dropping the window-focus re-offer: the guest is focused once at mount and never again after the window comes back, which is the desktop gap behind it — another app taking the front leaves the preview's only route out shut until the pane remounts. It fails only the new re-offer test, and the refusing-preview case beside it stays green, so the re-offer is pinned as gated rather than unconditional.\"\n        }",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked session-close routing suite is removed, including the explicit cross-worktree cleanup alarm. Remove its active file, command token and assertion reference; historical selectors and receipts retain their original scope. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3460 historical original active selectors (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx src/shared/document-preview/doc-preview-scheme.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/shared/document-preview/doc-preview-scheme.test.ts src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-preview-address-bar-convergence.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=list\",\n        \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\",\n        \"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-preview-local-render.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line --repeat-each=3\",\n        \"npx playwright test --config tests/playwright.config.ts --project=electron-headless tests/e2e/paired-remote-html-preview-local-render.spec.ts --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser/browser.test.ts\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line\",\n        \"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\"\n      ]\ntestFiles: [\n        \"src/main/runtime/browser/client-pages/orca-runtime-browser.test.ts\",\n        \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n        \"src/renderer/src/store/slices/browser/browser.test.ts\",\n        \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n        \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n        \"src/main/browser/sessions/partition-policies/browser-session-partition-policies.test.ts\",\n        \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n        \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n        \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n        \"src/main/browser/guest-lifecycle/manager/viewport/browser-manager-annotation-bridge.test.ts\",\n        \"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\n        \"src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts\",\n        \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n        \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n        \"src/renderer/src/lib/browser/documents/doc-preview-grants.test.ts\",\n        \"src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts\",\n        \"src/renderer/src/components/link-actions/LinkActionPopover.test.tsx\",\n        \"src/renderer/src/store/slices/browser/pages/browser-page-conversion.test.ts\",\n        \"src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-conversion-publish.test.ts\",\n        \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n        \"tests/e2e/paired-preview-address-bar-convergence.spec.ts\",\n        \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n        \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n        \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts\",\n          \"assertions\": [\"explicit cleanup cannot close a page owned by another worktree\"]\n        },\n        {\n          \"file\": \"src/renderer/src/store/slices/browser/browser.test.ts\",\n          \"assertions\": [\n            \"a requested canonical page ID is stored on the page rather than reused as its workspace ID\",\n            \"duplicate canonical page IDs are rejected before a second tab can materialize\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-html-preview-local-render.spec.ts\",\n          \"assertions\": [\n            \"the host's HTML document renders inside the client-local orca-preview guest\",\n            \"neither the client browser-workspace count nor the host browser-tab count moves off baseline\",\n            \"the preview opens in its own split with mode html-preview and leaves the source editor active\",\n            \"an explicit click reactivates the preview, and closing it preserves the source editor, its group, and the terminal\",\n            \"the document reports having attempted both its unattended and its post-press egress, so neither absence assertion can pass on a document that never tried\",\n            \"a scripted window.open and location.href driven by a real press elsewhere in the document route nothing and move no browser count\",\n            \"a real target=_blank press in the rendered document routes out as an Orca browser tab while the preview stays open\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/document-preview/doc-preview-file-reader.test.ts\",\n          \"assertions\": [\n            \"reads a document too large for one reply by range under the same grant\",\n            \"refuses a document rewritten between ranges instead of splicing versions\",\n            \"requires approval for a sibling directory before touching the runtime\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/document-preview/doc-preview-grant-registry.test.ts\",\n          \"assertions\": [\n            \"keeps silent authority over a document directory strictly inside the workspace, and only there\",\n            \"uses Windows semantics when authorizing a sibling directory\",\n            \"keeps an approved SSH directory inside the canonical workspace boundary\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/document-preview/doc-preview-failure-notice.test.ts\",\n          \"assertions\": [\"413 and 415 map to distinct reasons and everything else stays generic\"]\n        },\n        {\n          \"file\": \"src/main/browser/document-preview/doc-preview-guest-policy.test.ts\",\n          \"assertions\": [\n            \"never rebinds a bound guest onto a second grant\",\n            \"leaves a re-minted preview registered when the guest it replaced tears down\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/document-preview/doc-preview-scheme.test.ts\",\n          \"assertions\": [\n            \"malformed grant ids and unsupported schemes are refused\",\n            \"undecodable percent escapes are refused\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/slices/browser/pages/browser-workspace-doc-location.test.ts\",\n          \"assertions\": [\n            \"a document page's url is blank in the store, in the written session and after restore\",\n            \"a document navigation report leaves its URL blank, its title standing and nothing loading; its session excludes preview URLs\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx\",\n          \"assertions\": [\n            \"a preview that is the reader's surface hands its guest focus, and one that is not leaves focus alone\",\n            \"the window taking focus back re-offers it to the guest, and re-offers nothing for a preview that was refusing\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-browser-create-navigation-deadline.spec.ts\",\n          \"assertions\": [\n            \"a held navigation exceeds the former create deadline while the first RPC returns the exact authoritative host page ID\",\n            \"host inventory contains exactly one new page and the user retry branch is never entered\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts\",\n          \"assertions\": [\n            \"the exact created page exists on the host while publication is held and no browser tab materializes on the client\",\n            \"a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split\",\n            \"a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories\",\n            \"headed and headless hosts preserve the unrelated editor and terminal without local fallback\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\n          \"assertions\": [\n            \"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\n            \"retains exact-leaf focus intent when a split sibling publishes first\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Demote if a paired HTML preview creates a browser workspace on either side, renders from anything other than the orca-preview scheme, serves a read the host reported as truncated or over-cap, serves a document without the self-only content security policy, lets the preview session carry an off-machine request, reads an SSH path that canonicalizes outside its grant root, steals focus from the source editor when it opens, removes unrelated editor or terminal state on close, hides a document that rendered because one subresource was refused, leaves a grant readable after the tab or renderer that owns it is gone, mints one for a sender that is not the trusted renderer, opens a browser tab for a navigation the document started with no one at the keyboard, or lets the guest gather an ICE candidate; or if a paired browser creation this gate still owns produces duplicate client or host identities or loses its requested split."
    },
    {
      "id": "browser-network-tunnel.bounded-fail-closed-route",
      "title": "Client-hosted browser routes stay bounded and fail closed",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "shared-protocol-main-network-contract",
      "surfaces": [
        "client-hosted browser tunnel framing",
        "execution-host TCP credit flow",
        "capability-gated native and SSH execution-host adapters",
        "main-owned loopback SOCKS5 route",
        "runtime-owned browser-host lease and placement authority",
        "exact live client-page placement admission",
        "bounded client page-command dispatch and replay",
        "server-owned page-command issue and result ledger",
        "same-socket paired-runtime control requests",
        "paired desktop browser-host lifecycle composition",
        "same-pairing browser-host authority replacement",
        "bounded client-page reconciliation execution",
        "proof-driven server page-reconciliation orchestration",
        "capability-gated client-page reconciliation commands",
        "dedicated paired-runtime E2EE tunnel subscription"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": [],
      "coverageNotes": "Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
      ],
      "invariant": "A client-hosted browser network route exists only for an exact live server-owned browser-host lease, authority epoch, host generation, paired identity, execution-host revision or SSH provider authority, and server-owned route generation. A client page is usable only when its runtime ID, authority epoch, host identity and generation, logical page ID, page-host generation, current placement, and still-live lease all match atomically; a retired, retirement-pending, or server-placed page cannot be claimed as live client placement. Live logical placements and their identities are bounded, an occupied logical page cannot change placement until exact two-phase retirement completes, cancellation restores the same authority, and the runtime-wide page generation stays monotonic without tombstones. Server-issued page commands and results remain bounded, FIFO per page, immutable after admission, authenticated to the exact paired lease, attach connection, and live placement, and replayable only when byte-equivalent. Negotiated transient result-transport loss retains exact authority and replays unsettled commands through the preserved client dedupe cache; terminal authority loss makes outstanding outcomes unknown and makes only the exact host generation's placements non-cancellable retirement-pending until exact cleanup or reconciliation proof. Desktop composition installs exact command authority before delivery, keeps result settlements below nested-request capacity, suspends every tunnel without closing guests on negotiated loss, gates handlers through route recovery, and synchronously suspends routes and revokes exact retained navigation grants before asynchronous transport or handler cleanup on terminal loss. Navigation-revocation failure remains observable without preventing guest destruction and route cleanup. One environment pairing revision owns at most one composed desktop host and one reference-counted route per canonical execution-host key; pairing replacement and shutdown close control transport before pages and force-close routes even when guest cleanup remains ambiguous. Non-native descriptors require explicit capability negotiation and an exact runtime-minted lease-bound execution-host grant. Host selection never chooses arbitrarily, stale cleanup or settlement cannot remove a replacement, destination names remain unresolved until the execution host, credit returns only after writes settle, and route loss never falls back to desktop DNS or sockets. A main-owned local listener remains stable across upstream transport loss, rejects CONNECT while offline, accepts only a strictly newer tunnel generation, ignores superseded callbacks, and never reuses a stream ID within one generation. Pending opens, admitted open rate, nested control requests, per-route application bytes, aggregate browser-host/process bytes, claims, and socket sources remain bounded with exact release on settlement and retirement. Queued transport drain yields after a bounded quantum. The local SOCKS endpoint accepts only loopback CONNECT and rejects unsupported commands.",
      "oracle": "Test-value audit removes the retired suite and its active selectors/assertions. Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts src/main/ssh/system-transport/forwarding/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
        "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
        "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
      ],
      "testFiles": [
        "src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts",
        "src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts",
        "src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts",
        "src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts",
        "src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts",
        "src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts",
        "src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts",
        "src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
        "src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
        "src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
        "src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts",
        "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts",
        "src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts",
        "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts",
        "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts",
        "src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts",
        "src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts",
        "src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts",
        "src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts",
        "src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts",
        "src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
        "src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts",
        "src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts",
        "src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts",
        "src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts",
        "src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts",
        "src/main/browser/network/execution-routes/browser-network-execution-route.test.ts",
        "src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts",
        "src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts",
        "src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts",
        "src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts",
        "src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
        "src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
        "src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts",
        "src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts",
        "src/shared/remote-runtime/remote-runtime-client.test.ts",
        "src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts",
        "src/shared/ws-outbound-backpressure-queue.test.ts",
        "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts",
          "assertions": [
            "one paired device cannot consume the second device's reserved browser-host share",
            "asks and browser hosts share a ceiling that retains one quarter of total capacity for waits"
          ]
        },
        {
          "file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts",
          "assertions": [
            "an acknowledged mutation replay uses the preserved dispatcher result without rerunning its handler"
          ]
        },
        {
          "file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts",
          "assertions": [
            "waits for old handlers and ignores their late callbacks before replacement",
            "keeps one command gate across repeated loss while fencing stale route recovery",
            "fails closed without racing page cleanup when handlers do not settle"
          ]
        },
        {
          "file": "src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts",
          "assertions": ["holds Session and route release for the exact destroyed acknowledgement"]
        },
        {
          "file": "src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts",
          "assertions": [
            "destroys a guest rekeyed during an authority transition instead of granting navigation"
          ]
        },
        {
          "file": "src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts",
          "assertions": [
            "prepared authority rekeys without changing its opaque capability token",
            "stale, occupied, cross-page, and cross-renderer targets fail without mutation"
          ]
        },
        {
          "file": "src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts",
          "assertions": [
            "spontaneous exact guest destruction revokes active inventory before explicit page retirement"
          ]
        },
        {
          "file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts",
          "assertions": ["keeps a failed authority transition tombstoned until cleanup settles"]
        },
        {
          "file": "src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts",
          "assertions": [
            "retains one exact route until its final page releases it",
            "keeps an ambiguously closed route fenced until final registry cleanup",
            "retires old authority routes without destroying them before exact page cleanup",
            "aborts a stale route recovery without retaining its retry timer",
            "fails bounded recovery after one route exhausts grace without leaking timers",
            "mints a fresh route for a retain that lands while the previous one is closing",
            "waits for a route still closing before reporting retirement",
            "rejects a retain the moment its signal aborts mid-startup",
            "refuses a retain that waited out a closing route onto a retired registry",
            "reports a failed final cleanup to an awaiting retirement"
          ]
        },
        {
          "file": "src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts",
          "assertions": [
            "keeps a timed-out retirement fenced until its handler actually settles",
            "bounds close while canceling queued and non-cooperative handlers"
          ]
        },
        {
          "file": "src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts",
          "assertions": [
            "oversized wire payloads fail before page, sequence, or delivery admission",
            "new issue delivery failure closes the ledger and fences every outstanding outcome"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/browser/browser-client-host.test.ts",
          "assertions": [
            "negotiated exact reattach emits ready before replaying the unchanged unsettled command",
            "reattach before old cleanup preserves the same authority and ends only the superseded connection stream",
            "only the exact negotiated connection, paired device, and live page placement can settle a server-owned command",
            "exact duplicate results are idempotent while conflicts and stale or retired placement fail closed",
            "a second browser-host identity on one authenticated connection is rejected"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts",
          "assertions": [
            "command result settlement requires the exact negotiated reconciliation authority"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts",
          "assertions": [
            "replenishes client credit only after the destination write settles",
            "keeps concurrent streams alive when late data arrives for a retired stream",
            "flushes credited destination bytes before close",
            "caps aggregate retained destination bytes and releases exact stream accounting",
            "caps unsettled destination writes and releases retirement exactly once",
            "releases queued bytes once when an accepted send closes reentrantly"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts",
          "assertions": [
            "multiple execution-host routes share browser-host application-byte admission in both traffic directions",
            "route close releases aggregate claims exactly before stale destination-write callbacks"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts",
          "assertions": [
            "preserves remote DNS and waits for an opened acknowledgement",
            "sends only credited bytes in bounded frames and replenishes consumed input",
            "ignores a retired stream frame but rejects a never-allocated stream ID",
            "never reuses stream IDs within one generation after its bounded ledger exhausts",
            "replenishes only bytes settled after the readable consumer takes them",
            "fails closed when pending tiny destination frames exceed the chunk cap",
            "drains data that precedes a remote close before retiring the socket"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts",
          "assertions": [
            "application, encrypted-queue, and native socket bytes share one host ceiling",
            "distinct hosts share one process ceiling with exact release",
            "zero-byte claims, socket sources, hosts, and leases have independent bounds",
            "released leases cannot admit work and retained owners keep exact accounting alive",
            "unavailable native-buffer evidence fails closed until its exact source releases"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/remote-browser-socks-server.test.ts",
          "assertions": [
            "domain CONNECT preserves the final execution-host DNS target",
            "unsupported commands and unavailable routes open no fallback destination"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts",
          "assertions": [
            "ungranted or wrong-key SSH routes are rejected before resolver or binary registration",
            "connector diagnostics are mapped to a stable public error without local path disclosure",
            "grant revocation aborts connector startup immediately and cannot race through route admission",
            "the server allocates route generations and fences the replaced route"
          ]
        },
        {
          "file": "src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts",
          "assertions": [
            "closes a subscription that resolves after route teardown",
            "settles startup when close follows subscription acquisition before readiness",
            "bounds the post-auth readiness wait",
            "binds and releases the exact browser-host outbound memory lease",
            "keeps one listener fail-closed and accepts an increasing replacement generation",
            "ignores late callbacks from a superseded transport",
            "recovers again after a second transport death",
            "rejects a non-increasing replacement generation and remains retryable",
            "fences a ready generation even when the replacement closes before its await resumes",
            "replaces the tunnel generation before recycling a bounded stream ID"
          ]
        },
        {
          "file": "src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts",
          "assertions": [
            "destroy before source attachment emits one close and destroys a late source",
            "source close after destroy cannot emit duplicate wrapper close"
          ]
        },
        {
          "file": "src/main/browser/network/execution-routes/browser-network-execution-route.test.ts",
          "assertions": [
            "execution-host route keys cannot collide on delimiter-containing identities",
            "native routing accepts only the exact runtime revision without retaining an invalidation callback"
          ]
        },
        {
          "file": "src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts",
          "assertions": [
            "does not adopt a replacement ssh2 client under the captured authority",
            "releases a deferred socket when forwardOut throws during disconnect",
            "aborts system SSH startup when route authorization is revoked",
            "reaches external sites over ssh2 through the host proxy and keeps local names direct",
            "dials directly while the host environment is unreadable and adopts it once a retry reads it",
            "reaches external sites over system SSH through the host proxy"
          ]
        },
        {
          "file": "src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts",
          "assertions": [
            "the internal SOCKS5 client encodes the exact destination as a domain request"
          ]
        },
        {
          "file": "src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts",
          "assertions": [
            "authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately"
          ]
        },
        {
          "file": "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "assertions": [
            "an ephemeral sshd resolves a container-only domain and returns a unique HTTP marker",
            "the real ssh2 forwardOut receives that exact domain and provider loss fences the route",
            "one non-interactive system-OpenSSH dynamic forward passes the same remote-only oracle and closes cleanly"
          ]
        },
        {
          "file": "src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts",
          "assertions": [
            "nested JSON responses route by exact request ID under reverse-order delivery"
          ]
        },
        {
          "file": "src/shared/remote-runtime/remote-runtime-client.test.ts",
          "assertions": [
            "the authenticated socket binds the optional tunnel capability",
            "the dedicated outbound queue reports hard overflow instead of dropping a frame",
            "encrypted queue claims release synchronously while native socket ownership remains charged through exact close"
          ]
        },
        {
          "file": "src/shared/ws-outbound-backpressure-queue.test.ts",
          "assertions": [
            "direct and already-retained queued frames use distinct aggregate admission semantics",
            "queued drain yields after its configured frame quantum without reordering",
            "aggregate queue claims release on drain, denial, disposal, and close"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-14",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "result": "passed",
          "durationSeconds": 1.3,
          "summary": "Two tests passed: an ephemeral Linux sshd resolved remote-only.internal and returned the sta-4150-remote-only HTTP marker over real ssh2 forwardOut and one real system-OpenSSH dynamic forward; the ssh2 route also fenced on authority invalidation."
        },
        {
          "date": "2026-08-14",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-client.test.ts",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts",
          "result": "passed",
          "durationSeconds": 3,
          "summary": "Seventeen authenticated subscription tests passed, including tunnel capability binding and hard outbound-queue overflow rejection."
        },
        {
          "date": "2026-09-06",
          "runner": "ci",
          "platform": "linux",
          "command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "result": "passed",
          "durationSeconds": 28.29,
          "summary": "Previously excluded Docker SSH2 and system-OpenSSH remote-only domain journeys: 2/2 baseline cases (34043512327) plus 6/6 across three independent CI jobs (34043659504), zero skips/retries. Dedicated ssh-browser-network-route job now executes them for full E2E runs and matched source/test edits; preserves all original route and authority assertions."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1401; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1340; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic and paired-runtime suites passed locally; CI and soak history have not started for the stacked route stage."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1401 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1340 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The protocol and tunnel-session oracles fail on origin/main 3246b73add because the modules do not exist, then pass on the candidate. The lease registry and control-client suites were recorded red at missing modules before implementation. The unchanged tunnel authorization oracle was behaviorally red because an authenticated socket could self-assert its paired device ID and received ready generation 7 without a lease; it is green after server-owned lease and route fencing. On c9a41abf24, the unchanged admission oracle failed three ways: a second identity on one connection and a fifth identity for one paired device were both admitted, and closed page placement had no retirement API. All three pass after bounded admission and tombstone-free global page generations. Before the admission-fairness stage, one paired device's four hosts filled the global host cap and rejected a second device, initial runtime_busy was terminal, and reconnect runtime_busy ended preserved authority. Raising only the host cap then let asks and hosts starve ordinary waits. The reviewed candidate caps hosts at eight globally and four per authenticated paired device, caps asks plus hosts at twelve of sixteen polls, and retries runtime_busy only inside the existing attach or reconnect deadline; the unchanged oracle passes all 16 focused assertions with exact counter, subscription, and timer release. On parent 81eb14c849, the initial three replacement-barrier tests failed because occupied client and server pages could be overwritten without retirement; the candidate rejects every placement-kind overwrite before host selection, preserves capacity until exact retirement, and keeps replacement generations monotonic. On parent 32c0c7f309, all five two-phase retirement tests failed because retirement had only an immediate-delete API; the candidate fences pending pages, restores exact cancellation, rejects delayed tokens, and releases capacity only after exact completion. On parent 392d13be9f, the deterministic resource oracle admitted 17 pending opens, admitted a 129th open inside 10 seconds, and retained more than 8 MiB across one route; all three failed assertions pass on the candidate, which also covers unsettled writes and reentrant exact release. With aggregate enforcement replaced by a no-op scaffold on parent b32610e365, all three host/process memory assertions failed: host bytes, process bytes, claims, and socket sources were independently unbounded. They pass with exact owner release, client and execution-host application charging, encrypted queue/native socket charging, and bounded drain. On parent a089829521, stream exhaustion was not distinguishable, transport loss closed the local listener with ECONNREFUSED, reconnect opened no replacement subscription, and a ready generation that closed before await continuation could be replayed. The initial reconnect candidate also retained a dead transport after a client-side protocol failure and therefore refused replacement. The reviewed candidate keeps one fail-closed address, propagates protocol closure, strictly fences observed generations, ignores superseded callbacks, and recycles stream IDs only after replacement while preserving the v1 attach shape. Parent 9889adf4c5 accepts only a native executionHost schema and its handler unconditionally reads native runtimeId and revision; widening the schema made node typecheck fail at those exact assumptions before adapter integration. The candidate keeps native subscription bytes and capabilities unchanged, capability-gates SSH, rejects stale authority before binary registration, and passes exact domains through both adapter contracts. Before the reviewed authorization and lifecycle fix, 10 of 34 focused assertions failed: an ungranted SSH key reached the resolver, grants did not exist, native routes exposed a global never-settling invalidation promise, pre-attach destroy emitted no close, synchronous forwardOut escaped without cleanup, OpenSSH did not force a standalone process, and raw connector detail crossed the RPC boundary. The same 34 assertions pass with exact tokenized grants, optional native invalidation, one-close deferred sockets, caught synchronous opens, standalone OpenSSH, and stable public errors. The real paired journey failed at the missing network.browserTunnel method before explicit test injection, then passed with an exact control lease while both production registries remained closed. Full mutation/revert evidence remains to be collected before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit1900 removes direct-send and guard/counter inventories from the queue suite. Historical byte/count/drain budgets remain policy and earlier measurements apply only to their unchanged selectors. The reduced source has no fresh work-count or latency measurement; required performanceBudget and numeric runtime budget remain unchanged. Historical prior account (preserved verbatim): Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Data frames, send credit, pending bytes and chunk counts in both directions, streams, SOCKS handshake, and pipelined application bytes are bounded. Each route admits at most 256 streams (pending opens included), 1024 opens per monotonic 10-second window, and 8 MiB of session-owned queued or unsettled application bytes with exact settlement and retirement release. Multiple client routes share a 32 MiB browser-host and 128 MiB process ceiling across application copies, encrypted queue frames, and dynamic native socket buffers; the execution runtime uses the same per-host/process application policy. Claims, socket sources, host records, and leases have independent count caps; explicit close releases JavaScript queue claims synchronously while native socket ownership remains charged until exact socket close. Parked encrypted queues hand at most four frames to the native socket per immediate cooperative drain turn. One authenticated connection retains at most one browser host and one paired device at most four, with exact release restoring admission. Permanent browser-host polls use at most eight of sixteen slots and four per authenticated paired device; asks plus hosts use at most twelve, preserving four slots for ordinary waits. Admission retry adds no polling or subprocess: it owns one attach subscription and one timer at a time, uses deterministic client-specific jitter, and cannot outlive the existing attach timeout or negotiated reconnect grace. Each SSH route owns one ssh2 authority or one standalone system-SSH dynamic-forward process, keeps at most 64 KiB of stderr tail, and releases every adapter/socket on exact route close or provider rotation. The system-SSH process exposes a separate no-auth loopback SOCKS listener outside application stream/rate/memory accounting under the documented same-user desktop trust boundary. Credit returns only after the execution-host or browser-facing socket write settles, and the injected transport must explicitly accept each frame. Node stream-internal high-water bytes and strict cross-route scheduling evidence remain required before live tunnel advertisement."
      },
      "promotionCriteria": [
        "Charge Node stream-internal high-water bytes and prove cross-route fairness under slow physical links; add a strict scheduler if the four-frame yield quantum is insufficient.",
        "Approve all same-host local processes and users as inside the desktop trust boundary or replace SOCKS no-auth with Chromium-compatible process isolation.",
        "Isolate or authenticate the system-SSH dynamic SOCKS listener, prove the bound listener belongs to the owned child, and preserve authenticated ControlMaster-only targets without persistent forwarding.",
        "Add old/new peer coverage to the dedicated paired-runtime binary tunnel journey.",
        "Add WSL, headed Linux, and physical Windows evidence.",
        "Prove an Electron partition routes loopback, DNS, HTTP, HTTPS, WebSocket, workers, and speculative traffic without desktop fallback."
      ],
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts. Unresolved local/computed edges remain explicit debt. Retired active assertionRefs (raw original objects retained as historical only): {\n          \"file\": \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n          \"assertions\": [\n            \"static system-SSH forwards receive the connection's complete resolved build options\"\n          ]\n        }",
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged.",
        "Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged.",
        "Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim.",
        "The mock-only browser-session startup suite was removed, dropping its once-per-module and retry-after-initialization-throw call-count alarms.",
        "Eligible paired Electron clients advertise the runtime capabilities, use the production paired-tunnel method, and select the prepared route partition; older and ineligible clients do not.",
        "The two-phase token-safe page-retirement API has no production lifecycle caller until client placement activates.",
        "Application, encrypted queue, and native WebSocket bytes are aggregated, but Node stream-internal high-water bytes are only per-stream bounded and not charged to the host/process ledger.",
        "A four-frame queued-drain quantum yields between timers, but strict cross-route fairness and slow-link soak evidence are not complete.",
        "The loopback SOCKS endpoint uses Chromium-compatible no-auth and is not safe to activate until its desktop trust boundary is approved or isolated.",
        "The system-SSH adapter opens another no-auth loopback SOCKS listener outside tunnel accounting; its release-and-bind port can be claimed by a sibling process, and readiness proves only that some TCP listener answered.",
        "Standalone system-SSH cleanup is exact, but targets that require an already-authenticated ControlMaster, passphrase, PIN, or keyboard-interactive prompt can fail non-interactive route startup.",
        "Execution-host grant keys are not independently capped or ref-counted; activation requires one server-owned page or partition lifetime and bounded per-lease grant admission.",
        "Same-authority replay and concrete client reclaim, restore, and close application are deterministic, but server placement reconciliation still lacks dedicated authenticated command issuance and proof-driven placement rekey after runtime restart.",
        "SSH2 and system OpenSSH have isolated Docker evidence, but WSL, browserless serve, Electron proxy policy, UDP denial, and desktop DNS/socket capture are not exercised.",
        "Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/remote-browser-socks-server.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\"result\":\"passed\",\"durationSeconds\":3.9,\"summary\":\"Sixteen files passed 154 bounded page-command negotiation, legacy ready/revoked compatibility, exact authority, unnegotiated and stale-command delivery, lease, tunnel, memory, flow-control, SOCKS, and paired E2EE tests.\"}",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/remote-browser-socks-server.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\"result\":\"passed\",\"durationSeconds\":7.7,\"summary\":\"Sixteen files passed 131 route, lease, aggregate application/encrypted/native memory, exact release, bounded-drain, stable-listener and protocol-failure reconnect, v1 reattach compatibility, generation/stream-ID fencing, SOCKS, and real paired E2EE tests; the full runtime-RPC suite separately passed 1,349 tests with one skip.\"}",
        "Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.4,\n          \"summary\": \"Ten tests passed same-socket nested JSON request delivery, reverse-order exact-ID routing, unknown and duplicate response rejection, 32-request admission, serialization rollback, concurrent timeout teardown, queued/native memory release, and exact-once socket-registration and queue-claim denial.\"\n        }",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.9,\n          \"summary\": \"Eleven files passed 73 admission, lease, route-generation, bidirectional retained-byte/chunk, pending-open/rate, exact-release, SOCKS, and real paired E2EE tests; the full runtime-RPC suite separately passed 1,347 tests with one skip.\"\n        }",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.4,\n          \"summary\": \"Eleven files passed 67 lease, reserved long-poll and host admission, token-safe placement retirement, authority, capability, route-generation, adversarial-revocation, lifecycle, flow-control, SOCKS, and real paired E2EE tests.\"\n        }",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 13.61,\n          \"summary\": \"Test Files  15 passed (15); Tests  207 passed (207). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed.",
        "Audit1340 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/runtime-binary-message-router.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/runtime-binary-message-router.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.7,\n          \"summary\": \"Five files passed 19 source-flow, settled-consumption, chunk-bound, ordered-close, readiness-deadline, cleanup-failure, binary-routing, attach-authorization, and real paired-runtime E2EE SOCKS-to-HTTP tests.\"\n        }",
        "Audit1340 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"remote-runtime\",\"ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1340 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/runtime/runtime-binary-message-router.test.ts\",\n    \"assertions\": [\n      \"dedicated raw tunnel traffic cannot replace or be decoded as terminal stream traffic on the same connection\"\n    ]\n  }\n]",
        "Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope.",
        "Audit1372 historical assertion inventory, not current coverage: [{\"file\":\"src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts\",\"assertions\":[\"the authenticated server echoes and retains reconciliation only when explicitly requested\",\"command result settlement requires the exact negotiated reconciliation authority\"]}]",
        "Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
        "Audit1401 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-inventory.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.3,\n          \"summary\": \"Eleven files passed 145 exact inventory negotiation, 256-page and 768 KiB atomic bounds, worst-case JSON-escaped inventory identities, deterministic optional-URL compaction, legacy-command preservation when inventory is unencodable, legacy strip, immutable authenticated lease snapshot, strict v1/duplicate/foreign-client rejection, paired-device-bound previous-runtime restart admission, missing and unsolicited echo, create-to-active deduplication, renderer/guest-stale outcome-unknown classification, normalized URL bounds, composition sampling, RPC retention, and reconciliation tests.\"\n        }",
        "Audit1401 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1401 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts\",\n    \"assertions\": [\n      \"optional URLs compact by deterministic codepoint order without dropping required page identity\",\n      \"an unencodable complete snapshot declines inventory negotiation instead of dropping a page\"\n    ]\n  }\n]",
        "Audit1900 intentionally loses direct-send callback inventories, size/frame validation, zero-byte cap, storageSlots-counter, sent-cancel and initially-unwritable guard alarms. Prospective aggregate admission, cooperative drain quantum ordering and exact claim release remain, with all three source19 assertionRefs retained verbatim. No equivalent replacement, fresh queue measurement or full-gate execution is claimed. Only the changed-source November4 Linux44tests/4files5.58s receipt is retired; other active receipts and all prior historical strings remain unchanged.",
        "Audit1900 historical pre-removal browser tunnel receipt; not current validation of the reduced queue source. Complete original raw receipt object follows verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.58,\n          \"summary\": \"Test Files  4 passed (4); Tests  44 passed (44). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Exact retired authored alarms: 'expires cached results at exact per-page and global ceilings'; 'freezes accepted authority, command, and result snapshots'.",
        "Audit1918 historical original capacity assertion object; only the two cache/cloning assertion titles are retired. Remaining wire-admission and delivery-failure titles stay active. Complete original raw object:\n{\n          \"file\": \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n          \"assertions\": [\n            \"per-page and global result replay caches expire at exact ceilings\",\n            \"accepted authority, command, and result payloads remain immutable\",\n            \"oversized wire payloads fail before page, sequence, or delivery admission\",\n            \"new issue delivery failure closes the ledger and fences every outstanding outcome\"\n          ]\n        }",
        "Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n          \"assertions\": [\n            \"the control method stays out of production registration\",\n            \"only a negotiated authenticated paired-runtime connection receives a server-owned epoch and generation\",\n            \"page-command v1 is echoed only to an explicit v1 attach while legacy event shapes remain unchanged\",\n            \"page-inventory v1 is echoed only after a complete authenticated inventory is retained on the exact lease\",\n            \"negotiated exact reattach emits ready before replaying the unchanged unsettled command\",\n            \"reattach before old cleanup preserves the same authority and ends only the superseded connection stream\",\n            \"only the exact negotiated connection, paired device, and live page placement can settle a server-owned command\",\n            \"an unnegotiated runtime connection cannot submit command results\",\n            \"exact duplicate results are idempotent while conflicts and stale or retired placement fail closed\",\n            \"a second browser-host identity on one authenticated connection is rejected\",\n            \"legacy cleanup emits exact revocation while negotiated cleanup enters bounded unavailable grace\"\n          ]\n        }",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n          \"assertions\": [\n            \"the production RPC registry excludes the tunnel until route authorization exists\",\n            \"unnegotiated, self-asserted, stale, wrong-execution-revision, and stale-SSH-authority browser hosts register no binary handler\",\n            \"SSH execution-host descriptors require a separately negotiated capability\",\n            \"ungranted or wrong-key SSH routes are rejected before resolver, memory, or binary registration\",\n            \"connector diagnostics are mapped to a stable public error without local path disclosure\",\n            \"grant revocation aborts connector startup immediately and cannot race through route admission\",\n            \"execution-host invalidation closes the session and releases its connector exactly once\",\n            \"memory exhaustion opens no route or binary handler\",\n            \"the server allocates route generations and fences the replaced route\",\n            \"subscription cleanup removes the exact connection-owned raw handler\",\n            \"raw-handler cleanup failure cannot retain route memory or lease authority\"\n          ]\n        }",
        "Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts src/main/runtime/rpc/methods/session-tabs/session-tab-browser-placement-mutations.test.ts src/main/runtime/rpc/methods/session-tabs/session-tab-browser-placement-projection.test.ts\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/session-tabs/session-tab-browser-placement-mutations.test.ts\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/session-tabs/session-tab-browser-placement-projection.test.ts\"",
        "Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n          \"assertions\": [\n            \"browser-host attachment has a dedicated sub-cap that preserves ordinary wait admission\",\n            \"one paired device cannot consume the second device's reserved browser-host share\",\n            \"asks and browser hosts share a ceiling that retains one quarter of total capacity for waits\",\n            \"socket close aborts the exact host and wait handlers and releases both counters\"\n          ]\n        }",
        "Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged.",
        "Historical dynamic-forward assertion metadata before inventory retirement, preserved verbatim:\n{\n          \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n          \"assertions\": [\n            \"system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination\",\n            \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n          ]\n        }",
        "Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed.\nOriginal active selector fields, historical raw native JSON values:\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts src/main/ssh/system-transport/forwarding/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n        \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n        \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n      ]\ntestFiles: [\n        \"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\n        \"src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n        \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts\",\n        \"src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts\",\n        \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n        \"src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n        \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n        \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n        \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n        \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n        \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n        \"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts\",\n        \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n        \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n        \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n        \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n        \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n        \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n        \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n        \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n        \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n        \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n        \"src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n        \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n        \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n          \"assertions\": [\n            \"one paired device cannot consume the second device's reserved browser-host share\",\n            \"asks and browser hosts share a ceiling that retains one quarter of total capacity for waits\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n          \"assertions\": [\"closes a subscription acquired after local teardown\"]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n          \"assertions\": [\n            \"an acknowledged mutation replay uses the preserved dispatcher result without rerunning its handler\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n          \"assertions\": [\n            \"waits for old handlers and ignores their late callbacks before replacement\",\n            \"keeps one command gate across repeated loss while fencing stale route recovery\",\n            \"fails closed without racing page cleanup when handlers do not settle\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n          \"assertions\": [\"holds Session and route release for the exact destroyed acknowledgement\"]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n          \"assertions\": [\n            \"destroys a guest rekeyed during an authority transition instead of granting navigation\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n          \"assertions\": [\n            \"prepared authority rekeys without changing its opaque capability token\",\n            \"stale, occupied, cross-page, and cross-renderer targets fail without mutation\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n          \"assertions\": [\n            \"spontaneous exact guest destruction revokes active inventory before explicit page retirement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n          \"assertions\": [\"keeps a failed authority transition tombstoned until cleanup settles\"]\n        },\n        {\n          \"file\": \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n          \"assertions\": [\n            \"retains one exact route until its final page releases it\",\n            \"keeps an ambiguously closed route fenced until final registry cleanup\",\n            \"retires old authority routes without destroying them before exact page cleanup\",\n            \"aborts a stale route recovery without retaining its retry timer\",\n            \"fails bounded recovery after one route exhausts grace without leaking timers\",\n            \"mints a fresh route for a retain that lands while the previous one is closing\",\n            \"waits for a route still closing before reporting retirement\",\n            \"rejects a retain the moment its signal aborts mid-startup\",\n            \"refuses a retain that waited out a closing route onto a retired registry\",\n            \"reports a failed final cleanup to an awaiting retirement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n          \"assertions\": [\n            \"keeps a timed-out retirement fenced until its handler actually settles\",\n            \"bounds close while canceling queued and non-cooperative handlers\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n          \"assertions\": [\n            \"oversized wire payloads fail before page, sequence, or delivery admission\",\n            \"new issue delivery failure closes the ledger and fences every outstanding outcome\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n          \"assertions\": [\n            \"negotiated exact reattach emits ready before replaying the unchanged unsettled command\",\n            \"reattach before old cleanup preserves the same authority and ends only the superseded connection stream\",\n            \"only the exact negotiated connection, paired device, and live page placement can settle a server-owned command\",\n            \"exact duplicate results are idempotent while conflicts and stale or retired placement fail closed\",\n            \"a second browser-host identity on one authenticated connection is rejected\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n          \"assertions\": [\n            \"command result settlement requires the exact negotiated reconciliation authority\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n          \"assertions\": [\n            \"remote DNS names round-trip without client resolution\",\n            \"unknown versions, opcodes, oversized payloads, and length mismatches fail closed\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n          \"assertions\": [\n            \"replenishes client credit only after the destination write settles\",\n            \"keeps concurrent streams alive when late data arrives for a retired stream\",\n            \"flushes credited destination bytes before close\",\n            \"caps aggregate retained destination bytes and releases exact stream accounting\",\n            \"caps unsettled destination writes and releases retirement exactly once\",\n            \"releases queued bytes once when an accepted send closes reentrantly\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n          \"assertions\": [\n            \"multiple execution-host routes share browser-host application-byte admission in both traffic directions\",\n            \"route close releases aggregate claims exactly before stale destination-write callbacks\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n          \"assertions\": [\n            \"preserves remote DNS and waits for an opened acknowledgement\",\n            \"sends only credited bytes in bounded frames and replenishes consumed input\",\n            \"ignores a retired stream frame but rejects a never-allocated stream ID\",\n            \"never reuses stream IDs within one generation after its bounded ledger exhausts\",\n            \"replenishes only bytes settled after the readable consumer takes them\",\n            \"fails closed when pending tiny destination frames exceed the chunk cap\",\n            \"drains data that precedes a remote close before retiring the socket\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n          \"assertions\": [\n            \"application, encrypted-queue, and native socket bytes share one host ceiling\",\n            \"distinct hosts share one process ceiling with exact release\",\n            \"zero-byte claims, socket sources, hosts, and leases have independent bounds\",\n            \"released leases cannot admit work and retained owners keep exact accounting alive\",\n            \"unavailable native-buffer evidence fails closed until its exact source releases\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n          \"assertions\": [\n            \"domain CONNECT preserves the final execution-host DNS target\",\n            \"unsupported commands and unavailable routes open no fallback destination\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n          \"assertions\": [\n            \"ungranted or wrong-key SSH routes are rejected before resolver or binary registration\",\n            \"connector diagnostics are mapped to a stable public error without local path disclosure\",\n            \"grant revocation aborts connector startup immediately and cannot race through route admission\",\n            \"the server allocates route generations and fences the replaced route\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n          \"assertions\": [\n            \"closes a subscription that resolves after route teardown\",\n            \"settles startup when close follows subscription acquisition before readiness\",\n            \"bounds the post-auth readiness wait\",\n            \"binds and releases the exact browser-host outbound memory lease\",\n            \"keeps one listener fail-closed and accepts an increasing replacement generation\",\n            \"ignores late callbacks from a superseded transport\",\n            \"recovers again after a second transport death\",\n            \"rejects a non-increasing replacement generation and remains retryable\",\n            \"fences a ready generation even when the replacement closes before its await resumes\",\n            \"replaces the tunnel generation before recycling a bounded stream ID\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n          \"assertions\": [\n            \"destroy before source attachment emits one close and destroys a late source\",\n            \"source close after destroy cannot emit duplicate wrapper close\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n          \"assertions\": [\n            \"execution-host route keys cannot collide on delimiter-containing identities\",\n            \"native routing accepts only the exact runtime revision without retaining an invalidation callback\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n          \"assertions\": [\n            \"does not adopt a replacement ssh2 client under the captured authority\",\n            \"releases a deferred socket when forwardOut throws during disconnect\",\n            \"aborts system SSH startup when route authorization is revoked\",\n            \"reaches external sites over ssh2 through the host proxy and keeps local names direct\",\n            \"dials directly while the host environment is unreadable and adopts it once a retry reads it\",\n            \"reaches external sites over system SSH through the host proxy\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n          \"assertions\": [\n            \"the internal SOCKS5 client encodes the exact destination as a domain request\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n          \"assertions\": [\n            \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n          \"assertions\": [\n            \"an ephemeral sshd resolves a container-only domain and returns a unique HTTP marker\",\n            \"the real ssh2 forwardOut receives that exact domain and provider loss fences the route\",\n            \"one non-interactive system-OpenSSH dynamic forward passes the same remote-only oracle and closes cleanly\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n          \"assertions\": [\n            \"nested JSON responses route by exact request ID under reverse-order delivery\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n          \"assertions\": [\n            \"the authenticated socket binds the optional tunnel capability\",\n            \"the dedicated outbound queue reports hard overflow instead of dropping a frame\",\n            \"encrypted queue claims release synchronously while native socket ownership remains charged through exact close\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n          \"assertions\": [\n            \"direct and already-retained queued frames use distinct aggregate admission semantics\",\n            \"queued drain yields after its configured frame quantum without reordering\",\n            \"aggregate queue claims release on drain, denial, disposal, and close\"\n          ]\n        }\n      ]",
        "Test-value audit: Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. No equivalent replacement or fresh execution is claimed."
      ],
      "demotionRule": "Keep experimental or demote if a self-asserted or ambiguous host can receive a route, an SSH descriptor bypasses capability, lease-bound grant, or provider-authority checks, late cleanup can remove a replacement, a route can resolve names on the desktop, exceed a byte or stream bound, replenish credit before destination settlement, accept a stale or non-increasing generation, reuse a stream ID within one generation, lose or bypass its fail-closed listener during reconnect, expose the SOCKS listener off-loopback, accept BIND/UDP, or fall back when the selected route is unavailable."
    },
    {
      "id": "browser-client-host.route-partition-policy",
      "title": "Client-hosted browser partitions apply route policy before attachment",
      "maturity": "experimental",
      "protection": "none",
      "owner": "browser-runtime",
      "layer": "electron-main-session-security-boundary",
      "surfaces": [
        "route- and profile-scoped Electron partitions",
        "persistent partition binding metadata",
        "fixed SOCKS5 session policy",
        "webview partition allowlist"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1396 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Deterministic main-process tests cover versioned delimiter-safe aggregate partition derivation, path-safe opaque names, durable collision metadata, oversized or corrupt metadata refusal, missing-sidecar Chromium-data refusal, bounded binding/live-page admission, immediate SOCKS5 setup with Chromium loopback bypass disabled, inherited-connection closure, exact proxy verification before allowlisting, concurrent setup coalescing, live proxy-retarget refusal, token-safe page replacement, existing browser-profile policy installation, active Orca-profile storage scoping, blank-only initial attachment, arbitrary initial-navigation denial, and fail-closed per-guest WebRTC policy through delayed or failed cleanup. The production client-page executor prepares, registers, and grants the exact route page. Archived standalone Electron experiments measured TCP routing and a forced persisted-worker wake using fixture-owned proxy setup; they did not exercise production route preparation and are no longer current test coverage. A separate capture proves the protected guest sends zero direct STUN packets. An archived standalone H3 experiment measured WebTransport and forced-QUIC controls through fixture-owned proxy setup and checked the shipped Direct Sockets feature list. It did not exercise Orca route preparation or admission and is no longer current product coverage. An archived DNS-prefetch experiment observed an accepted Electron 43 residual: prefetched hostnames resolved on the desktop outside the tunnel. It asserted the leak and was removed; current production-path TCP, persisted-worker, and DNS-prefetch egress coverage remains incomplete. Network-service restart and WSL provider journeys remain uncovered. Four Linux Docker SSH browser baseline scenarios passed: direct-host routing, unavailable-host local escape, forwarding refusal, and paired client-hosted reconnect. All four scenarios subsequently passed three repetitions each (12 passes, no skips or retries) in Linux CI run 34040309638, with unchanged assertions and timeouts. Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews",
        "https://github.com/stablyai/orca/actions/runs/34039986047",
        "https://github.com/stablyai/orca/actions/runs/34040309638"
      ],
      "invariant": "A client-hosted partition is derived only in main from stable Orca-profile, browser-profile, authority-connection, and execution-host identities. Raw identities and individually linkable component hashes never enter its path-safe partition name. Durable binding metadata must match and precede Chromium partition data before reuse. One live partition never changes execution host or proxy endpoint. Fixed SOCKS5 setup starts immediately after Session creation, before policy installation can yield or a persisted worker is awakened; no partition enters the webview allowlist until browser policy is installed, inherited connections are closed, and resolveProxy returns exactly that one listener. Initial route-partition attachment is blank-only. Its exact WebContents is quarantined before applying non-proxied WebRTC denial and remains navigation- and popup-denied if policy application or cleanup fails. Distinct live partitions, retained logical page generations, durable bindings, and binding-file reads remain bounded. No UDP transport a route-partition page can reach — WebRTC, WebTransport, or forced QUIC — emits a datagram to the desktop, the Direct Sockets constructors stay absent from every guest so no page can kill its renderer, and the process never enables a DoH host-resolver mode.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1396 retired changed-source receipts. Historical oracle account: Derive two delimiter-adversarial identities and require distinct full-digest path-safe partitions with no raw IDs or component hashes. Persist one binding, reload it, and reject replacement, malformed or oversized state, Chromium data without matching metadata, and the 513th binding. Prepare one partition and require setProxy with <-loopback> to be invoked immediately after getSession and before policy setup, then closeAllConnections and exact SOCKS5 resolveProxy while isAllowedPartition remains false; only then may it become live. Reject DIRECT, endpoint retargeting, and capacity overflow. Require quarantine before disable_non_proxied_udp and admission; under real Electron require the unprotected control to emit STUN and the protected guest to emit zero direct UDP packets.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1396 retired changed-source receipts; reduced selector has no new soak result. Historical account: The deterministic suite passes locally. Linux SSH provider journeys passed four baseline cases and twelve repeated cases in CI runs 34039986047 and 34040309638 with zero skips or retries. Long-term and cross-platform soak history remains incomplete."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1396 changed referenced test sources; no new red/green validation. Historical account: The TCP A/B control first reached all six target paths directly, while the fixed SOCKS arm routed the same HTTP, HTTPS, WebSocket, redirect, subresource, and download traffic plus remote DNS with zero direct target connections. The two-launch worker control reached desktop localhost before setProxy; immediate setProxy routed the same wake and later fetch through SOCKS. The WebRTC control emitted four direct STUN packets until disable_non_proxied_udp reduced the capture to zero. Non-WebRTC UDP and network-service restart remain explicit residuals. Historical receipts before removing the source-only tests, preserved verbatim with their originally executed commands (the narrowed commands were not rerun here): [{\"date\":\"2026-08-20\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-h3-egress.electron.test.ts src/main/browser/browser-route-dns-prefetch.electron.test.ts src/main/startup/secure-dns-census.test.ts\",\"result\":\"passed\",\"durationSeconds\":21,\"summary\":\"The direct control emitted 5 WebTransport and 6 forced-QUIC datagrams while the SOCKS route partition emitted zero of each. With Direct Sockets explicitly enabled the control exposed TCPSocket/UDPSocket/TCPServerSocket and constructing one killed the guest renderer; the shipped disable-features list left all three undefined and the renderer alive. The dns-prefetch tripwire recorded HOST_RESOLVER_SYSTEM_TASK for the prefetched host with zero events for an unreferenced control host, documenting the accepted local-resolution residual.\",\"notes\":\"The dns-prefetch expectation intentionally asserts the leak. Flip it to an empty event list when the upstream Electron PrefetchDNS fix lands.\"}] Archived provider-experiment receipts after removing the standalone TCP and persisted-worker suites, preserved verbatim with their originally executed commands (remaining and narrowed commands were not rerun here): [\n        {\n          \"date\": \"2026-08-17\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-tcp-egress.electron.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1,\n          \"summary\": \"The real Electron direct control reached all six TCP request surfaces; the fixed SOCKS session carried HTTP, HTTPS, WebSocket, redirects, subresources, downloads, and remote DNS with zero direct target connections.\"\n        },\n        {\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/sessions/browser-route-session-registry.test.ts src/main/browser/browser-route-persisted-worker-egress.electron.test.ts src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 10,\n          \"summary\": \"Three files passed 28 tests. The two-launch worker control reached desktop localhost before proxy setup; immediate setProxy invocation routed the same wake and a later worker fetch through SOCKS with path-attributed direct counts remaining zero. Both resolved and rejected proxy setup keep failed-policy retries joined through connection cleanup. The protected WebRTC guest emitted zero direct UDP packets.\"\n        }\n      ]"
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1396 changed test sources; no new measurement. Previous account: Derivation performs one bounded full SHA-256 aggregate partition hash and one binding hash. The registry admits at most 64 live or pending partitions, 64 logical page generations per partition, and 512 durable bindings per Orca profile. Concurrent preparation shares one promise and one Electron proxy application per partition. Binding-file reads are capped at 128 KiB. Writes are bounded synchronous profile-local JSON, fsync the temporary file before Windows-retried rename, and fsync the containing directory where supported."
      },
      "promotionCriteria": [
        "Use the production paired journey to prove proxy application precedes the first popup and speculative request.",
        "Prove spontaneous persisted-worker background events cannot issue network requests between Session creation and immediate proxy invocation on macOS, Linux, and Windows; add a worker hold only if that evidence requires it.",
        "Prove network-service restart cannot reset the partition to DIRECT or system proxy.",
        "Activate a trusted exact-WebContents registration/grant flow before navigation, and fence reload, popup, restore, profile-switch, renderer-crash, and stale-cleanup paths.",
        "Disable or capture every remaining UDP, QUIC, DoH, and non-SOCKS desktop egress path on macOS, Linux, and Windows."
      ],
      "knownGaps": [
        "The mock-only browser-session startup suite was removed, dropping its once-per-module and retry-after-initialization-throw call-count alarms.",
        "Historical receipt before standalone test removal, preserved with its originally executed command; remaining commands were not rerun for this audit: {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-identity.test.ts src/main/browser/browser-route-partition-binding-store.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-session-registry.test.ts src/main/browser/browser-session-startup.test.ts src/main/window/createMainWindow.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/partitions/browser-route-identity.test.ts src/main/browser/routing/partitions/browser-route-partition-binding-store.test.ts src/main/browser/routing/sessions/browser-route-session-registry.test.ts src/main/browser/sessions/browser-session-registry.test.ts src/main/browser/sessions/browser-session-startup.test.ts src/main/window/createMainWindow.test.ts\",\"result\":\"passed\",\"durationSeconds\":0.5,\"summary\":\"Six files passed 150 opaque identity, durable collision binding, bounded partition/page, proxy-before-allowlist, policy reuse, profile startup, and blank-only attach tests.\"}",
        "The production client-page executor calls preparePage before renderer mounting and navigation grant.",
        "Archived standalone experiments routed a manually forced persisted-worker wake after fixture-owned setProxy invocation; production-path TCP routing, spontaneous worker wake timing, and DNS-prefetch containment still require direct application coverage across platforms.",
        "The route partition permits only blank initial attachment; the production executor registers and grants only the exact main-observed WebContents.",
        "Network-service recovery, speculative requests, and popup traffic remain incompletely captured.",
        "QUIC, DoH, WebTransport, and non-WebRTC UDP/direct-network paths are not yet disabled or proven fail closed.",
        "Partition deletion, download/transfer draining, idle route release, disk quotas, and browser-profile cloning are later lifecycle stages.",
        "Binding writes serialize in Electron main, and packaged hosts rely on Orca's per-userData single-instance lock. Activation still needs an explicit guard for dev instances that share userData or a cross-process CAS/lock.",
        "Sequential proxy or policy setup failures retain durable bindings and can exhaust the 512-binding ledger. Activation requires bounded tombstone recovery and partition garbage collection.",
        "Each preparePage synchronously reads and parses bounded binding metadata on Electron main; activation requires latency evidence or a safely invalidated cache before this becomes frequent.",
        "New SSH browser journey evidence is limited to Linux CI with Docker; native macOS/Windows clients and WSL providers remain unverified by these scenarios.",
        "Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. No equivalent replacement coverage is claimed.",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8,\n          \"summary\": \"Two files passed 24 assertions; the real Electron control emitted direct STUN, while the exact per-guest policy emitted zero desktop UDP packets and policy failure remained quarantined through delayed or failed close.\"\n        }",
        "Audit1396 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"ssh\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1396 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/browser/routing/partitions/browser-route-identity.test.ts\",\n    \"assertions\": [\n      \"aggregate partition and durable binding fingerprints are stable and opaque\",\n      \"delimiter-containing identities remain structurally distinct\",\n      \"individual component equality and Windows-illegal path separators are absent\",\n      \"empty and unbounded identity components are rejected\"\n    ]\n  },\n  {\n    \"file\": \"src/main/browser/routing/partitions/browser-route-partition-binding-store.test.ts\",\n    \"assertions\": [\n      \"opaque bindings survive restart\",\n      \"replacement and malformed metadata fail closed\",\n      \"oversized metadata and Chromium data without a binding fail closed\",\n      \"persisted binding count is bounded\"\n    ]\n  },\n  {\n    \"file\": \"src/main/browser/routing/sessions/browser-route-session-registry.test.ts\",\n    \"assertions\": [\n      \"policy, proxy, connection closure, and verification finish before allowlisting\",\n      \"DIRECT and endpoint retargeting are rejected\",\n      \"non-loopback listeners and invalid page generations are rejected before persistence\",\n      \"missing browser profiles consume no durable binding capacity\",\n      \"partial setup cleanup and concurrent setup settle exactly once\",\n      \"partition and page-generation counts are bounded\",\n      \"stale page cleanup cannot retire its replacement\"\n    ]\n  },\n  {\n    \"file\": \"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\n    \"assertions\": [\n      \"route guests apply non-proxied WebRTC denial before admission\",\n      \"policy failure remains quarantined through delayed or failed guest close\"\n    ]\n  },\n  {\n    \"file\": \"src/main/window/createMainWindow.test.ts\",\n    \"assertions\": [\n      \"a live route partition may attach only the normalized blank document\",\n      \"an arbitrary URL cannot be the initial route-partition document\"\n    ]\n  }\n]",
        "Audit1396 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\",\n    \"assertions\": [\n      \"the unprotected SOCKS-partition control emits direct STUN packets\",\n      \"disable_non_proxied_udp leaves the exact guest with zero direct UDP packets\"\n    ]\n  }\n]",
        "Audit1396 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/browser/routing/partitions/browser-route-identity.test.ts\",\n          \"assertions\": [\n            \"aggregate partition and durable binding fingerprints are stable and opaque\",\n            \"delimiter-containing identities remain structurally distinct\",\n            \"individual component equality and Windows-illegal path separators are absent\",\n            \"empty and unbounded identity components are rejected\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/routing/partitions/browser-route-partition-binding-store.test.ts\",\n          \"assertions\": [\n            \"opaque bindings survive restart\",\n            \"replacement and malformed metadata fail closed\",\n            \"oversized metadata and Chromium data without a binding fail closed\",\n            \"persisted binding count is bounded\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/routing/sessions/browser-route-session-registry.test.ts\",\n          \"assertions\": [\n            \"policy, proxy, connection closure, and verification finish before allowlisting\",\n            \"DIRECT and endpoint retargeting are rejected\",\n            \"non-loopback listeners and invalid page generations are rejected before persistence\",\n            \"missing browser profiles consume no durable binding capacity\",\n            \"partial setup cleanup and concurrent setup settle exactly once\",\n            \"partition and page-generation counts are bounded\",\n            \"stale page cleanup cannot retire its replacement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\",\n          \"assertions\": [\n            \"the unprotected SOCKS-partition control emits direct STUN packets\",\n            \"disable_non_proxied_udp leaves the exact guest with zero direct UDP packets\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\n          \"assertions\": [\n            \"route guests apply non-proxied WebRTC denial before admission\",\n            \"policy failure remains quarantined through delayed or failed guest close\"\n          ]\n        },\n        {\n          \"file\": \"src/main/window/createMainWindow.test.ts\",\n          \"assertions\": [\n            \"a live route partition may attach only the normalized blank document\",\n            \"an arbitrary URL cannot be the initial route-partition document\"\n          ]\n        }\n      ]",
        "Audit1396 archived active selectors after retirement of all passed receipts: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/partitions/browser-route-identity.test.ts src/main/browser/routing/partitions/browser-route-partition-binding-store.test.ts src/main/browser/routing/sessions/browser-route-session-registry.test.ts src/main/browser/sessions/browser-session-registry.test.ts src/main/window/createMainWindow.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\"],\"testFiles\":[\"src/main/browser/routing/partitions/browser-route-identity.test.ts\",\"src/main/browser/routing/partitions/browser-route-partition-binding-store.test.ts\",\"src/main/browser/routing/sessions/browser-route-session-registry.test.ts\",\"src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts\",\"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\"src/main/browser/sessions/browser-session-registry.test.ts\",\"src/main/window/createMainWindow.test.ts\"]}"
      ],
      "demotionRule": "Keep experimental or demote if raw identities enter a partition path, a durable binding mismatch is reused, a partition retargets to another execution host or live listener, a route partition becomes attachable before exact proxy verification, initial attachment can navigate beyond blank, stale cleanup retires a replacement, admission exceeds a declared cap, or any browser request reaches desktop DNS, TCP, UDP, localhost, or system proxy outside the selected route."
    },
    {
      "id": "browser-client-host.webcontents-quarantine",
      "title": "Route guests stay blank and popup-denied until exact registration",
      "maturity": "experimental",
      "protection": "none",
      "owner": "browser-runtime",
      "layer": "electron-main-webcontents-authority",
      "surfaces": [
        "route guest did-attach lifecycle",
        "exact host renderer and WebContents ownership",
        "top-frame preload request admission",
        "document-owned retained renderer webviews",
        "logical page-generation registration",
        "post-registration navigation grant",
        "route popup fail-closed policy"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1363 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic main-process fakes cover route-Session recognition after logical release, prepared-page renderer ownership, stale and live waiters sharing pending partition setup, generic-policy-before-route-lockdown ordering, blank quarantine, exact guest/renderer/partition/logical-page registration, opaque page-authority replacement, a separate navigation grant, repeated navigation, invalid-scheme denial, dynamic page-authority revocation, popup denial, delayed/failed admission closure, exact page-release closure, retirement-start and destroyed-inspection failure, shared-partition retirement ordering, policy retention until every destroyed acknowledgement, guest process loss/destruction, opaque lifecycle claims across spontaneous destruction and WebContents ID reuse, owning-renderer process loss before, during, and after registration, mutable input isolation, page conflicts, and token-safe destroyed cleanup. The production page-command executor additionally retains an exact execution-host route, prepares its immutable partition, mounts one trusted renderer generation blank, registers and grants its exact guest, loads only normalized HTTP(S), and attempts every safe generation-scoped cleanup after failure, abort, or retirement while holding network resources without destruction proof. A production main-process bridge binds mount and retirement requests to the exact current renderer object and document generation, rejects sender spoofing and WebContents-ID reuse, carries no target URL, bounds pending requests, aborts, timeouts, malformed replies, and lifecycle replacement, and restores only an exact surviving renderer document after blocked or failed provisional navigation. The top-frame preload now queues and validates bounded requests before one replaceable subscriber, while a document-owned renderer registry mounts only blank route webviews, bounds global and per-partition guests, and fences attachment, retirement, destruction, and renderer loss by the full page tuple. Real Electron 43.1.0 proves exact main-frame reply admission, delayed guest-ID readiness, blank attachment, host ownership, destruction, and fail-closed denied attachment. Normal browser Sessions and paired web clients bypass the renderer registry. Production host composition and client placement activate the executor only after capability-gated placement preparation. Process/document swaps, worker/request/download settlement, traffic containment, and provider journeys remain uncovered. Audit1363: src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts removed. Missing preload/web-client flags, mount/rekey/retire forwarding and failure-code projection. No equivalent replacement coverage is claimed. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim. Audit1421 reduces browser-client-page-retained-registry.test.ts to its attached-generation destruction fence and wrong-generation retirement case. Blank mount, budgets, rekey, guest-ID readiness, process-loss, denied-attachment timeout and absent-page retirement unit alarms are lost. Synthetic webview events do not establish native Electron lifecycle delivery. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; this reduced suite has no new execution result.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
      ],
      "invariant": "A prepared route page binds its opaque authority to one exact main-observed renderer WebContents while that page generation is active or retiring. Before requesting a blank guest, the production command executor must retain the exact execution-host route, verify its key, and prepare the route/profile partition for one still-current renderer generation. Main sends the approved opaque partition and exact page generation, but no target URL, through one bounded request admitted against the exact current renderer object and document generation; only a schema-valid reply from that same object, request, operation, and page generation can settle it. Preload accepts requests only in the top frame, binds outcomes to the admitted request, fails overflow and unavailable subscribers within a bounded interval, and fences callbacks replaced by a newer document subscriber. Renderer retains each blank webview under one non-React document host keyed by the exact partition, page ID, and generation, never reparents it, and holds an attached or process-lost generation until exact destruction. Renderer replacement, WebContents-ID reuse, abort, timeout, malformed reply, disposal, and process loss fence pending work without admitting a late reply. Renderer-document replacement retires before commit, while blocked external navigation is ignored and failed or cancelled provisional navigation restores only the exact surviving frame. A WebContents whose Electron Session has belonged to a prepared route partition is quarantined synchronously after generic guest policy installation, including when page authority disappears between will-attach and did-attach. It must be a live blank webview owned by the exact renderer WebContents. Nonblank navigation remains denied until main matches the exact partition, browser page, page-host generation, guest WebContents, renderer WebContents, and opaque live page authority, then issues a separate grant. Every later navigation rechecks the same opaque guest incarnation and page authority, so reusing a logical tuple or WebContents ID cannot revive a stale guest. Releasing that authority, losing or destroying the guest process, or losing its owning renderer before, during, or after registration synchronously fences pending authority admission, ends exact logical authority, revokes navigation, and closes any attached guest through the same retirement barrier. Failed, aborted, or retired creation attempts revoke the exact guest and renderer mount before releasing the Session and route, attempt every safe cleanup, and never clear or admit a replacement generation after uncertain cleanup. Session and route release require exact guest destruction proof; an ambiguous mount outcome retains them. If close is delayed or fails, the partition stays outside attachment admission and route policies remain installed until the exact destroyed acknowledgement. Route popups remain denied throughout. Active and retiring page maps and pending renderer requests are bounded, stale callbacks cannot retire or clear replacements, and non-route browser guests retain existing behavior.",
      "oracle": "Audit1421 narrows renderer unit coverage as recorded in coverageNotes. Prior oracle descriptions are historical for the changed suite. The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Prepare a page for one renderer and require authority lookup and registration by a sibling renderer to fail; reject owner replacement while the generation is active or retiring, then lose the owning renderer before guest registration and require only its prepared pages to retire. Pause partition setup, lose the owner, and require its waiter to fail without authority; add a live sibling waiter to the same pending setup and require only that waiter to admit; exceed the configured waiter cap and require immediate refusal. Make policy cleanup throw in the first of two owned partitions and require the sweep to retire both without restoring admission. Through the production executor, retain one exact route, prepare its partition, mount blank on one current renderer, register and grant the exact guest in order, then load only its normalized HTTP(S) URL. Queue renderer requests before subscription, replace one subscriber, overflow both request and page budgets, race attachment with retirement, delay guest identity until DOM readiness, lose the guest renderer, and require exact bounded settlement without reparenting or cross-partition collision. Under real Electron, require the main bridge to accept only the actual main-frame reply, match the positive renderer WebContents ID to did-attach-webview, destroy it on retirement, and reject and remove a denied unprepared guest. Reject a mismatched route, stale renderer or page generation, and file URL without touching Chromium. Abort or fail registration after mount and require exact guest, renderer, Session, and route cleanup in that order; make renderer cleanup reject but require destruction before later release, and keep the generation fenced from replacement. Make guest retirement fail or mount outcome ambiguous and require every safe cleanup while Session and route remain retained. Destroy a guest spontaneously before command cleanup, reuse its WebContents identity, and require the old opaque claim not to retire the replacement while the replacement claim still can. Attach a blank route guest and require nonblank navigation plus every popup to be denied. Reject a wrong renderer, wrong page generation, nonblank initial document, wrong WebContents type, destroyed guest, and excess attachment; delay or fail its close and require navigation and popups to remain denied. Register the exact prepared tuple and prove navigation remains denied until a second grant; then allow repeated HTTP(S) navigation while continuing to deny file navigation and popups. Release logical page authority with delayed guest close; require immediate navigation revocation, one exact close, no partition admission, no policy cleanup, and same-tuple preparation refusal until destroyed acknowledgement. Make destroyed inspection throw and require retirement plus navigation to remain fail-closed until the explicit destroyed event. Acknowledge destruction, require one policy cleanup, reprepare the tuple, replay stale acknowledgement, and prove the replacement remains admitted. Make retirement startup throw and require policy plus capacity to remain fail-closed. Retire two pages sharing one partition and require cleanup only after both exact acknowledgements. Emit guest render-process-gone and destroyed, and emit owning-renderer process loss through the main-window boundary; require exact logical retirement, close, and grant revocation while unrelated renderer guests and prepared pages survive. Reject retirement for the wrong opaque authority. Reprepare after ordinary release, require a new opaque authority, deny the stale guest, and admit an exact replacement. Destroy a registered guest under real destroyed state, verify best-effort listener release, replay stale cleanup, and prove its replacement remains grantable. Mutate caller input after registration and prove main-owned authority is unchanged. Attach a normal browser Session and require no route-registry mutation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1363; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic and isolated real-Electron suite passes locally; CI and cross-platform soak history have not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1363 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The route-WebContents oracle first failed because no registry existed, and the Session oracle failed because no exact Session/page index existed. A first candidate blocked every navigation after the initial document committed because it incorrectly required the current URL to remain blank; repeated-navigation evidence failed until blank validation was limited to registration and grant. Mutable-input evidence then proved caller-owned data could alter stored authority until the registry copied it. Fresh review found late and rejected attachments could keep generic navigation policy, destroyed cleanup skipped listener release, and tuple reuse revived stale grants; the added deterministic cases fail that candidate and pass with retained Session recognition, deny-first admission, best-effort destroyed cleanup, and opaque authority tokens. The page-release oracle then failed because no exact retirement handshake existed; it passes with synchronous revocation plus policy cleanup held behind the exact destroyed callback. Guest-process, guest-destruction, and owning-renderer loss tests then failed because none ended logical page authority; the candidate routes all three through exact fenced retirement. Prepared-owner tests subsequently failed because a sibling renderer received the same live authority and no pre-registration renderer-retirement method existed; the candidate binds live authority to the exact owner and sweeps only that renderer's prepared pages. Fresh review then reproduced cleanup-failure sweep abort, pending authority resurrection, and live-partition success after owner loss; snapshot-first retirement, best-effort cleanup, renderer epochs, and the final async-boundary check now fence stale work while allowing an unrelated live waiter to admit the verified partition. The executor baseline lacked the module, exact guest navigation, and unregistered retirement. Later deterministic probes caught early route release after renderer failure, ambiguous mount leakage, failed-create readmission, discarded destruction proof, proof-ledger eviction, WebContents ID reuse, and stale navigation; the candidate keeps a bounded failed-page fence and retains an immutable opaque guest claim whose destruction promise, retirement, and navigation survive spontaneous loss without targeting a replacement. Renderer-lifecycle review then reproduced blocked-navigation detachment, stale same-URL cancellation, and a concurrent failure plus blocked-replacement stuck fence; constant document-generation and idle-state tracking makes those exact sequences green without retaining a navigation list. The renderer baseline had no preload consumer or retained page registry. Its first real-Electron candidate failed because getWebContentsId was transiently unavailable at did-attach, then because pre-attach destruction released state without rejecting the mount; DOM-readiness retry and exact pre-attach destruction settlement make both sequences green. A later deterministic sequence proved did-attach cancelled the timeout before a guest ID existed and retirement released the observed guest without destruction; retaining the deadline through valid identity and recording observed attachment make both sequences green. Fresh review then caught cached re-advertisement after guest identity became unreadable and an unhandled rejection when reply transport threw; exact live-ID comparison now fences the stale incarnation, while safe reply construction and transport containment leave main's timeout as the bounded recovery. Real Electron mutation/revert, lifetime page-generation authority, worker/request settlement, and traffic evidence remain required before activation."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Session, guest, page, and exact-owner lookups are O(1), install no polling, and retain at most 256 attached route guests in registry maps in addition to the lower 64-partition and 64-active-or-retiring-page-per-partition bounds. The production executor retains at most 256 active, creating, or failed page IDs; each observed guest owns one immutable lifecycle claim and one destruction promise, with no global tombstone ledger. The renderer bridge retains at most 512 pending mount or retirement requests, one timer and optional abort listener per request, and one app-lifetime IPC reply listener; settlement, abort, timeout, replacement, and disposal remove each exactly once. Preload independently retains at most 512 validated requests and one timer each, removes queued identifiers on every settlement, and exposes one replaceable subscriber. The renderer retains at most 256 exact page tuples and 64 per partition, one host, webview, timer, promise, and four lifecycle listeners each; attached retirement keeps bounded fail-closed tombstones until destruction. Renderer-document tracking retains only constant generation, active-fence, and cancellation state across concurrent navigation events. At most 64 callers per partition can await one setup promise. Renderer loss scans at most 256 guests plus 4,096 bounded active pages and snapshots only exact owner matches. Each guest retains at most one retirement callback. Historical Session recognition uses weak keys. Normal guests perform one bounded Session lookup at did-attach. Destroyed guests synchronously release exact mappings and attempt each listener removal independently."
      },
      "promotionCriteria": [
        "Use Playwright CDP in real Electron to prove did-attach lockdown precedes page script, popup, redirect, worker, and speculative activity.",
        "Extend exact WebContents release fencing to service workers, downloads, active requests, network-service recovery, ordinary document/process swaps, profile switch, lease replacement, and app shutdown.",
        "Implement bounded generation-scoped popup reservations without any shell.openExternal or native-window fallback."
      ],
      "knownGaps": [
        "Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim.",
        "The production host lifecycle, route resolver, and retained renderer surface are active for eligible paired Electron clients; headed and headless paired-runtime product journeys cover the normal creation path on macOS.",
        "Real Electron main-frame reply, delayed guest-ID readiness, denial, destruction, and retained visible attachment are covered locally; process swaps, traffic isolation, and physical-platform behavior remain unvalidated.",
        "Guest and owning-renderer process-loss fencing is deterministic only; real Electron crash/reload ordering and WebContents process recovery remain unvalidated.",
        "Logical page release now revokes and closes the exact WebContents while holding policy cleanup for destroyed acknowledgement, but does not yet prove service-worker, download, active-request, connection, or persistent-storage settlement.",
        "A close that never reaches destroyed or a retirement that cannot start intentionally keeps the route policy and capacity reserved; bounded force-close recovery must not clear policy under a live or unknown guest.",
        "A failed or ambiguous create remains fenced until authenticated inventory reconciliation proves whether the guest exists; a real transport-loss recovery journey remains to be recorded.",
        "The runtime-owned placement registry supplies monotonic page generations after retirement; persistence across a full authority restart remains deterministic rather than a packaged-upgrade journey.",
        "Popup reservations do not exist; every route guest popup is denied.",
        "The production caller derives renderer, page, host generation, and route identity from live main-owned state; physical Windows and Linux Electron ordering remain unvalidated.",
        "Audit1363: src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts removed. Missing preload/web-client flags, mount/rekey/retire forwarding and failure-code projection. No equivalent replacement coverage is claimed.",
        "Audit1363 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/renderer/browser-client-page-renderer-bridge.test.ts src/main/browser/client-pages/renderer/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/routing/sessions/browser-route-session-registry.test.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.22,\n          \"summary\": \"On the candidate atop #14753, twelve files passed 132 exact opaque-claim navigation revocation, in-flight create fencing, revocation-error cleanup, retained guest destruction separation, route Session, renderer bridge/registry, Electron lifecycle, and main-window document assertions.\"\n        }",
        "Audit1363 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/renderer/browser-client-page-renderer-bridge.test.ts src/main/browser/client-pages/renderer/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/routing/sessions/browser-route-session-registry.test.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.7,\n          \"summary\": \"Twelve files and 199 tests passed the existing main authority gate plus top-frame preload queueing, bounded outcomes, exact retained renderer tuples, delayed guest-ID readiness, idempotent retirement, resource budgets, process-loss fencing, and real Electron main-frame reply, blank attachment, denial, and destruction lifecycle.\"\n        }",
        "Audit1363 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1421 reduces browser-client-page-retained-registry.test.ts to its attached-generation destruction fence and wrong-generation retirement case. Blank mount, budgets, rekey, guest-ID readiness, process-loss, denied-attachment timeout and absent-page retirement unit alarms are lost. Synthetic webview events do not establish native Electron lifecycle delivery. No equivalent replacement coverage is claimed. Historical receipts remain scoped to unchanged selectors; this reduced suite has no new execution result."
      ],
      "demotionRule": "Demote if a route guest can navigate nonblank before exact registration and grant, a mismatched, released, crashed, or ownerless page remains authoritative, tuple reuse revives stale authority, page release clears route policy before exact guest destruction, a stale retirement clears a replacement, a popup reaches shell.openExternal or an unregistered native window, a rejected attachment retains navigation or popup capability, stale cleanup retires a replacement, normal browser guests change behavior, or any claimed exact identity is sourced only from renderer input."
    },
    {
      "id": "browser-client-host.activated-placement",
      "title": "Eligible paired Electron clients host new browser pages without dual execution",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "paired-runtime-product-placement-and-materialization",
      "surfaces": [
        "browser tab creation from the renderer store",
        "paired Electron host preparation",
        "runtime-owned browser placement publication",
        "retained client webview materialization",
        "client-hosted automation routing",
        "new-page-only kill switch"
      ],
      "platforms": ["macos", "linux", "windows", "ios"],
      "providers": ["remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": ["macos", "ios", "linux"],
      "coveredProviders": ["remote-runtime", "ssh", "wsl"],
      "coverageNotes": "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Fresh-build Playwright journeys run the same production store action against an isolated headed Electron server and a real headless orca serve host. They prove one immutable client placement owns one real retained guest on the viewing desktop, the server owns no duplicate guest, no screencast frame renders, browser.snapshot reaches the client guest, disabling the setting preserves that guest, and the next page uses the legacy server engine. Deterministic contracts cover omitted placement, missing capabilities, explicit server placement, exact renderer-store materialization after delayed publication, no fallback after client-create failure, folder workspaces, git worktrees, browserless hosts, native and WSL routes, exact connected SSH authority, reconnect command replay, lease replacement, imported-inventory cleanup, bounded retirement, and shared remote screencast fanout for multiple independent viewers. A published v1.4.184 package runs both skew directions: an old client omits placement against the current host, while a current client capability-downgrades against the old host; each creates one server guest, no client guest, and returns the exact snapshot marker. A current iOS Simulator client paired to that legacy packaged host visibly loads Example Domain through the preserved server-hosted surface. A Docker OpenSSH target proves container-only DNS and localhost through both ssh2 and system-SSH routes. Physical Windows/Linux Electron and physical mobile journeys remain gaps. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. Schema-only placement/navigation acceptance is excluded from behavioral and mixed-version evidence. The mocked client-placement and immediate create-failure suites were removed, including parameter selection, delayed mocked materialization and no-fallback call ledgers. The remaining live journeys and contracts do not establish equivalent unit alarms. Earlier descriptions and executed results for those fixtures are historical.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
      ],
      "invariant": "Placement is selected exactly once before page creation. An eligible, capable paired Electron desktop creates one client-hosted guest; old, ineligible, web/mobile, browserless-client, or explicit-server callers use the unchanged server path. Omitted placement remains server-hosted. Once client placement is selected, failure is surfaced and must not create, migrate, or fall back to a server guest. The acknowledged exact environment, worktree or folder workspace, remote page, and target group must materialize before the renderer reports success. Client pages bypass screencast and remote-input rendering, while agent and CLI automation routes only to the exact client guest. Disabling the kill switch affects only later pages. Reconnect, replacement, and cleanup preserve exact authority and never revive or retire another generation.",
      "oracle": "Test-value audit removes the retired suite and its active selectors/assertions. Retire screencast lifecycle restart/argument/frame-count and malformed-frame ACK examples; decoded frame freshness and stream cases remain with narrower scope. Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Create through the normal renderer-store action with client hosting enabled. Require client placement, one client-owned guest at the fixture URL, zero server-owned guests, no remote-browser frame, a visible retained marker, and a browser.snapshot marker from the same remote page. Disable the setting and require that guest to survive; create another page and require one server-owned guest, zero matching client guests, and a visible server screencast. Delay renderer publication after tabCreate acknowledgement and require one exact bounded subscription to materialize the page without polling or cleanup. Reject a client create and require no server fallback. Omit placement or capabilities and require no client-host RPC. During replacement, admit close-first only for negotiated reconciliation of imported inventory; ordinary close-first and navigate-first remain rejected. Run the same placement oracle against headed and headless paired hosts, plus deterministic native, SSH, WSL, folder, worktree, reconnect, retirement, and browserless-host contracts.",
      "commands": [
        "pnpm exec playwright test tests/e2e/paired-client-hosted-browser.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-creation.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/ipc/runtime-environments/runtime-environment-browser-client-host-handler.test.ts",
        "SKIP_BUILD=1 ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE=/Applications/Orca.app/Contents/MacOS/Orca pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/wsl-browser-network-execution-route.test.ts src/main/browser/network/execution-routes/wsl-browser-network-relay-launch.test.ts src/main/runtime/browser/network/runtime-browser-network-execution-host.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/cdp/screencast/browser-screencast-stream.test.ts src/main/runtime/browser/screencast/orca-runtime-browser-screencast-fanout.test.ts",
        "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
        "Manual iOS 26.5 simulator: pair current mobile code to packaged Orca 1.4.184; create Browser; navigate to https://example.com; require one visible Example Domain tab on the server-hosted surface",
        "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
      ],
      "testFiles": [
        "tests/e2e/paired-client-hosted-browser.spec.ts",
        "src/main/runtime/browser/client-pages/runtime-browser-client-page-creation.test.ts",
        "src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts",
        "src/shared/remote-runtime/remote-runtime-client.test.ts",
        "src/main/ipc/runtime-environments/runtime-environment-browser-client-host-handler.test.ts",
        "tests/e2e/packaged-mixed-version-browser-placement.spec.ts",
        "src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts",
        "src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts",
        "src/main/browser/network/execution-routes/browser-network-execution-route.test.ts",
        "src/main/browser/network/execution-routes/wsl-browser-network-execution-route.test.ts",
        "src/main/browser/network/execution-routes/wsl-browser-network-relay-launch.test.ts",
        "src/main/runtime/browser/network/runtime-browser-network-execution-host.test.ts",
        "src/main/browser/cdp/screencast/browser-screencast-stream.test.ts",
        "src/main/runtime/browser/screencast/orca-runtime-browser-screencast-fanout.test.ts",
        "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/paired-client-hosted-browser.spec.ts",
          "assertions": [
            "headed and headless product actions select one client placement with one viewing-desktop guest and no server duplicate",
            "client pages render without a remote screencast and browser.snapshot reaches the exact retained guest",
            "the kill switch preserves existing client pages and selects server placement only for the next page"
          ]
        },
        {
          "file": "tests/e2e/packaged-mixed-version-browser-placement.spec.ts",
          "assertions": [
            "an old packaged client omits placement and creates exactly one current-host guest with no client guest",
            "a current client detects an old packaged host, keeps server placement, and creates no local guest",
            "both skew directions return the exact server-hosted snapshot marker"
          ]
        },
        {
          "file": "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "assertions": [
            "ssh2 and system OpenSSH resolve a container-only domain and localhost on the execution host"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-16",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/paired-client-hosted-browser.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 48.8,
          "summary": "Two fresh-build production journeys passed against isolated headed Electron and real headless orca serve hosts, including client ownership, visible retained content, automation, no screencast, new-page-only kill switch, and server fallback without duplicate execution.",
          "currentCommand": "pnpm exec playwright test tests/e2e/paired-client-hosted-browser.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-16",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE=/Applications/Orca.app/Contents/MacOS/Orca pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 10.3,
          "summary": "Two packaged v1.4.184 skew journeys passed four times (9.6, 10.3, 9.5, and 10.3 seconds), including after the latest-main rebase: old client to current host and current client to old host each selected server placement, owned one host guest and zero client guests, and returned packaged-skew-marker through browser.snapshot.",
          "currentCommand": "SKIP_BUILD=1 ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE=/Applications/Orca.app/Contents/MacOS/Orca pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-16",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "result": "passed",
          "durationSeconds": 3.31,
          "summary": "Two real Docker/OpenSSH routes resolved and loaded a container-only HTTP target through ssh2 and system SSH.",
          "currentCommand": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
        },
        {
          "date": "2026-08-16",
          "runner": "manual",
          "platform": "ios",
          "command": "Manual iOS 26.5 simulator: pair current mobile code to packaged Orca 1.4.184; create Browser; navigate to https://example.com; require one visible Example Domain tab on the server-hosted surface",
          "result": "passed",
          "durationSeconds": 180,
          "summary": "Current mobile code paired to an isolated legacy packaged host, created one Browser tab, and visibly progressed from about:blank through loading to Example Domain at https://example.com/ on the server-hosted mobile surface.",
          "currentCommand": "Manual iOS 26.5 simulator: pair current mobile code to packaged Orca 1.4.184; create Browser; navigate to https://example.com; require one visible Example Domain tab on the server-hosted surface"
        },
        {
          "date": "2026-09-06",
          "runner": "ci",
          "platform": "linux",
          "command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
          "result": "passed",
          "durationSeconds": 28.29,
          "summary": "Previously excluded Docker SSH2 and system-OpenSSH remote-only domain journeys: 2/2 baseline cases (34043512327) plus 6/6 across three independent CI jobs (34043659504), zero skips/retries. Dedicated ssh-browser-network-route job now executes them for full E2E runs and matched source/test edits; preserves all original route and authority assertions.",
          "currentCommand": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 300,
        "scope": "fresh-build headed and headless paired Electron journeys plus deterministic placement, compatibility, reconnect, route, and Docker SSH contracts"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The fresh headed/headless and deterministic matrices pass locally; CI and cross-platform soak history have not started for the activated cumulative tip."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Before activation, production capability advertisement, client-host RPC registration, placement preparation, runtime client creation, logical publication, retained mounting, and automation routing were absent. During cumulative validation, delayed post-ack renderer publication caused the real paired journey to declare failure before the exact page materialized; the new deterministic delayed-publication test was red until a bounded exact Zustand subscription replaced the immediate check. Reconnect validation was then red 3 of 116 because the activation ordering guard rejected replacement-ledger close-first reconciliation for client-reported imported inventory; admitting only reconciliation close-first made the unchanged lifecycle package green 116 of 116 while a new unit oracle keeps ordinary close-first rejected. The paired tunnel integration was red 3 of 3 because its fixture duplicated methods now registered by the production registry; exercising ALL_RPC_METHODS directly is green 3 of 3. Packaged old/new skew and a current-mobile/legacy-host journey are now green; full candidate-revert evidence remains to be collected before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Placement preparation performs one fresh capability/status check and starts or reuses one exact browser host. Materialization uses one bounded exact store subscription with no polling and releases it on match or timeout. Each client page owns one retained non-reparented webview, one route/profile partition, one reference-counted execution-host grant, and bounded command/result state. Automation reuses the existing AgentBrowserBridge through one bounded negotiated envelope rather than duplicating browser methods. Headed and headless journeys each create exactly one client guest and one later server guest with no duplicate engine."
      },
      "promotionCriteria": [
        "Run the same production placement and traffic-isolation oracle on physical Windows and Linux Electron hosts, including headed and headless where supported.",
        "Capture real Electron HTTP, HTTPS, WebSocket, worker, redirect, speculative, DNS, WebRTC, and UDP/DoH behavior to prove no desktop-network fallback.",
        "Complete fresh architecture, compatibility, lifecycle, security, performance, and test reviews on the rebased landing stack."
      ],
      "knownGaps": [
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged.",
        "Live production journeys are macOS-only; WSL is deterministic and SSH uses Docker Linux rather than physical Windows/Linux Electron.",
        "The packaged skew journey uses one published old package plus the current E2E artifact on macOS; packaged Windows/Linux and a second independently released post-feature package remain unrecorded.",
        "The live fixture proves routed HTTP, HTTPS, WebSocket, redirect, subresource, and download ownership plus remote DNS through the fixed SOCKS session; worker, speculative, WebRTC, UDP, and DoH containment remain unrecorded.",
        "The setting currently requires explicit enablement while product rollout policy is decided; disabling it is intentionally new-page-only.",
        "The mocked client-placement and immediate create-failure suites were removed, including parameter selection, delayed mocked materialization and no-fallback call ledgers. The remaining live journeys and contracts do not establish equivalent unit alarms. Earlier descriptions and executed results for those fixtures are historical.",
        "The browser-placement schema suite was retired; its initial optional-field inventory is no longer active coverage. Historical local/macos run on 2026-08-16: pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-browser-placement.unit.test.ts; passed in 0.23s. Three assertions passed against published v1.4.182 and the current tree: the release lacks the negotiated capabilities, strips additive placement without changing legacy fields, and the current server preserves an old request with omitted placement. No replacement equivalence is claimed.",
        "Test-value audit: Retire screencast lifecycle restart/argument/frame-count and malformed-frame ACK examples; decoded frame freshness and stream cases remain with narrower scope. No equivalent replacement or fresh execution is claimed."
      ],
      "demotionRule": "Demote if placement changes after creation, a client failure creates a server fallback page, one logical page owns two engines, an omitted or unnegotiated field activates client hosting, the execution route resolves on the viewing desktop, a client page uses screencast/input RPC rendering, automation reaches a different page or engine, delayed publication leaks listeners or causes cleanup of a materialized page, or the kill switch mutates an existing page."
    },
    {
      "id": "browser-stream.bounded-reconnect",
      "title": "Remote browser streams recover within a bounded retry budget",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "renderer-state-machine-paired-runtime",
      "surfaces": [
        "paired remote browser panes",
        "browser screencast disconnect and reconnect",
        "remote browser viewport restart"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": ["remote-runtime"],
      "coverageNotes": "The retained fake-clock scheduler cases check bounded exhaustion, rejected attempts continuing to exhaustion, in-flight cancellation, and one queued replacement chain. Direct transient-success counted-delay, healthy-budget reset, and pending-cancellation cases were removed. Existing lifecycle and paired-runtime coverage remain separate and were not re-reviewed as equivalent replacements in this audit. The historical headless paired journey disconnects the real runtime, shows Reconnect, reconnects the same host, and requires a new frame. Headed paired-server, Windows, sleep/wake, and real network-partition evidence remain uncollected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/12787",
        "https://linear.app/stably/issue/STA-3483"
      ],
      "invariant": "A current remote browser stream that closes must retry transient failures on one counted, capped backoff chain. Cancellation, pane or runtime supersession, missing pages, and permanent failures stop that chain without stale state mutation. A stream that stays healthy refills the budget; a silent or flapping stream cannot retry forever. Exhaustion and every non-retrying failure leave an actionable Reconnect control, and manual reconnect creates a fresh stream without resurrecting stale subscriptions.",
      "oracle": "The retained direct scheduler oracles require finite exhaustion, continuation after rejected attempts, cancellation of in-flight ownership without re-arming, and one queued replacement chain. Existing lifecycle assertions separately describe stale pane/operation/stream/page/runtime refusal, liveness, and manual recovery; they are not claimed equivalent to removed direct scheduler cases. The paired-runtime oracle paints a remote frame, disconnects its owning runtime, observes the bounded-retry notice and Reconnect control, reconnects, and requires a different frame object URL.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts",
        "pnpm exec playwright test tests/e2e/paired-remote-browser-stream-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts",
        "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts",
        "tests/e2e/paired-remote-browser-stream-reconnect.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts",
          "assertions": [
            "budget exhaustion stops exactly once",
            "cancellation retires an in-flight attempt without re-arming",
            "a close during an in-flight attempt queues one replacement chain",
            "rejected attempts continue until budget exhaustion"
          ]
        },
        {
          "file": "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts",
          "assertions": [
            "dropped, silent, and flapping streams converge on a bounded retry or actionable stop",
            "stale, superseded, missing-page, and permanent-failure work cannot mutate the current pane",
            "manual reopen starts a fresh budget and adopts one current subscription",
            "a late stale rejection cannot clear the replacement stream's ready deadline"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-browser-stream-reconnect.spec.ts",
          "assertions": [
            "a real paired-runtime disconnect ends with an actionable Reconnect control",
            "manual reconnect paints a new remote frame instead of retaining only the frozen frame",
            "a pane whose first open fails can recover from no prior subscription"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-07",
          "runner": "ci",
          "platform": "linux",
          "command": "pnpm exec playwright test tests/e2e/paired-remote-browser-stream-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 59.8,
          "summary": "Both isolated headless paired-runtime scenarios passed: bounded recovery after a live-stream disconnect and manual recovery when the first stream never opened."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused fake-clock renderer contracts plus one isolated headless paired-runtime journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic suite and one changed-E2E CI run passed; soak history has not started."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The direct one-versus-four transient-success mutation oracle was removed. Historical handoff and stale-lifecycle mutation descriptions are preserved below as provenance; no fresh mutation run validates the reduced scheduler suite or supplies equivalent replacement coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Each pane retains at most one retry timer, one in-flight attempt, and one ready deadline. Automatic recovery makes at most five counted attempts with no global scan, subprocess, polling loop, or cross-pane fanout; exhaustion stops background work until explicit user reconnect."
      },
      "promotionCriteria": [
        "Run the same journey against a headed Orca desktop server and retain independent host/client state evidence.",
        "Collect Linux and physical Windows paired-server evidence plus sleep/wake or network-partition recovery.",
        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake.",
        "Replace the E2E's post-exhaustion elapsed-time check with an exact subscribe-attempt oracle."
      ],
      "knownGaps": [
        "The paired journey covers headless orca serve, not the primary headed desktop-server topology.",
        "The live fault is an explicit disconnect rather than sleep/wake or a real network partition.",
        "The E2E observes UI convergence and new frame identity but does not count screencast subscribe attempts directly.",
        "Live Linux and Windows evidence is uncollected.",
        "Audit1833 removed direct transient-success counted-delay, healthy-budget reset, and pending-cancellation cases. No equivalent lifecycle coverage is claimed.",
        "Audit1833 retires this complete dated local receipt because the selected scheduler was reduced; its 61 tests and currentCommand are not current candidate validation. Original receipt verbatim: {\"date\":\"2026-08-07\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts\",\"result\":\"passed\",\"durationSeconds\":0.36,\"summary\":\"Four focused files passed 61 deterministic error, status, scheduler, lifecycle, in-flight ownership, stale-rejection, liveness, and cleanup tests.\"}",
        "Historical red/green description retired from current completeness evidence, not re-executed by audit1833: {\"status\":\"complete\",\"evidence\":\"The byte-identical scheduler oracle fails with the reschedule disabled at one attempt instead of four and passes after restoration. On the PR head, the delayed handoff oracle counted two scheduled attempts instead of one, and the late stale-rejection oracle lost the replacement ready deadline and never offered reconnect; both pass after the ownership fixes. Current main structurally contains the original one-shot timer dead end. The focused suite passes 61 tests, and the isolated paired-runtime CI journey passes both disconnect and cold-open recovery scenarios.\"}"
      ],
      "demotionRule": "Keep experimental or demote if retries can stop before recovery or exhaustion, continue after exhaustion, run in parallel, mutate a superseded pane, hide the Reconnect control, leak a subscription or timer, or fail to paint a new frame after manual reconnect."
    },
    {
      "id": "editor.live-log-append-stability",
      "title": "Long live session logs retain their Monaco viewport while appending",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "editor-runtime",
      "layer": "renderer-electron-contract",
      "surfaces": [
        "Agent Session History View Log",
        "Monaco external-content reconciliation",
        "renderer crash containment"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1677 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Focused tests and real-Monaco 9/50 MiB performance and undo-retention benchmarks are platform-independent. Local macOS Electron evidence opens a synthetic 9 MiB transcript through Agent Session History at fixed 900x720 viewport, 13px font, 1x zoom, and asserts the full 9 MiB model length loaded as a font-metric-independent containment check (word-wrap pixel geometry varies ~10% across runners, so a generous content-height floor is only a collapsed/truncated-render smoke check), then verifies three five-second-cadence watcher appends with Find open and closed. Live Windows/Linux evidence remains uncollected.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/8432"],
      "invariant": "Append-only external file growth changes only Monaco's model suffix, retaining the viewport, selection, Find state, and renderer liveness above the append point; read-only live tails do not create undo history, while editable external updates remain undoable and arbitrary rewrites continue to replace the model content.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Focused tests assert one post-mount content owner and actual lifecycle remount ordering across retained path models. Real-Monaco tests cover undo behavior for read-only live tails versus editable files. Standalone Node timing and private undo-retention budgets at 9 and 50 MiB were retired by audit1677 and provide no current alarm. The Electron scenario compares legacy setValue with watcher appends, checking visible ranges, selection, Find state, scroll offset, non-undoability, renderer survival and memory budgets. Mock-only edit-shape assertions were retired during test-value audit.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
        "node --expose-gc ./node_modules/vitest/vitest.mjs bench --pool=threads",
        "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
        "tests/e2e/agent-session-log-tail-stability.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
          "assertions": [
            "a real Monaco read-only live-tail append leaves canUndo false while an ordinary external update remains undoable"
          ]
        },
        {
          "file": "tests/e2e/agent-session-log-tail-stability.spec.ts",
          "assertions": [
            "production Agent Session History opens a synthetic 9 MiB View Log and confirms the full model length loaded as font-metric-independent containment, with a generous content-height floor as a collapsed/truncated-render smoke check",
            "an executable e2e-only legacy setValue control disrupts selection/Find/anchor state at each fixed-geometry five-second sample, then restores the equivalent model state before the fixed arm",
            "three alternating watcher suffix appends preserve visible ranges, selection, scroll offset, Find open/query/active-match state, and exact suffix content",
            "the production read-only live-tail model remains non-undoable before and after every watcher append",
            "the renderer remains responsive with no render-process-gone event and forced-GC JS-heap/working-set/private-memory peak and retained budgets hold against paired legacy controls"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
          "result": "passed",
          "durationSeconds": 4,
          "summary": "The real-Monaco undo-history test confirmed a read-only live-tail append leaves canUndo false while an ordinary external update remains undoable."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 600,
        "scope": "local focused renderer tests plus one Electron production-journey scenario"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New deterministic gate with local macOS passes; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Historical red/green record predating audit1677, which retires standalone Node benchmark alarms: A fail-first real-Monaco test observed canUndo=true after one read-only live-tail append, and the forced-GC 50 MiB control retained 104,858,630 bytes in Monaco's undo service. After the fix the read-only arm retained zero undo-service bytes while the editable control stayed undoable. The retained Electron gate also proves each fixed watcher arm preserves viewport, selection, Find state, and non-undoability. Production builds never install its legacy setValue control."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical measurements recorded before audit1677; standalone Node timing and private undo/ArrayBuffer budget alarms are now retired. No replacement budget is claimed. Every update retrieves the model value once and performs at most one equality-or-prefix comparison; a matching append submits only the suffix. The registered Node commands require --expose-gc and --pool=threads so worker GC is available. Current p95: 9 MiB append 5.93-7.12ms versus replacement 114.09-145.89ms; 50 MiB append 26.84-34.91ms versus replacement 602.36-699.21ms. The new 50 MiB retention arm measured 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes for the undoable control versus zero for read-only live-tail sync. Electron forced-GC JS-heap, renderer working-set, and OS-private-memory budgets also pass."
      },
      "promotionCriteria": [
        "Collect stable soak history on macOS, Linux, and Windows.",
        "Accumulate 100 consecutive deterministic gate passes or 14 days without unexplained flakes."
      ],
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 78,\n          \"summary\": \"The production View Log journey alternated retained e2e-only legacy-red controls with fixed appends from restored equivalent state; every control detected instability while the fixed path retained viewport, selection, complete Find state, renderer liveness, and normalized forced-GC/native memory budgets.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 78,\n          \"summary\": \"The production View Log journey preserved viewport, selection, Find state, renderer liveness, and forced-GC/native budgets across three watcher appends while canUndo remained false.\"\n        }",
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1677 retires standalone Node p95, timing ratio and private Monaco undo-service/ArrayBuffer budgets. Remaining correctness/Electron scopes retain their existing provenance; no fresh execution or equivalent replacement is claimed.",
        "Audit1677 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No live Windows or Linux View Log evidence yet.",
        "Historical retired benchmark receipt (not active evidence): {\"date\":\"2026-07-12\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads\",\"result\":\"passed\",\"durationSeconds\":75,\"summary\":\"Forced-GC, settled, alternating fresh-model Monaco p95: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms.\"}",
        "Historical retired benchmark receipt (not active evidence): {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads\",\"result\":\"passed\",\"durationSeconds\":5,\"summary\":\"The undoable 50 MiB control retained 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes; the read-only live-tail arm retained zero of both and remained non-undoable.\"}",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx. Lost alarms: unmounts the prior path before reconciling a stale retained target model; keeps the diff editor mounted when a save updates the modified content; still remounts the diff editor for an explicit reload request. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope."
      ],
      "demotionRule": "Quarantine the Electron scenario if it flakes without a product or harness bug; demote if viewport/Find drift, renderer loss, or Electron memory retention exceeds the registered budgets."
    },
    {
      "id": "terminal-session.snapshot-freshness",
      "title": "Stale liveness snapshots cannot close newer PTY bindings",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-unit",
      "surfaces": ["terminal lifecycle", "dead-session reconciliation", "tab creation"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1948: Audit1944 removes the sole narrow reconcile-predicate suite. Timestamp equality, local membership and remote/SSH exclusion examples are accepted lost alarms; the suite does not independently drive a requested-snapshot/late-binding close race. No current automated oracle or validated coverage remains for this gate, and no equivalent replacement is claimed. Historical prior account (preserved verbatim): Local macOS evidence over the reconcile guards that exist on main@1282f5c2d. Broader targeted-hasPty resume paths, no-hot listing counts, and live Electron survival arrive with the pending reliability stack.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/6773",
        "https://github.com/stablyai/orca/pull/6514",
        "https://github.com/stablyai/orca/pull/6796",
        "https://github.com/stablyai/orca/pull/6801"
      ],
      "invariant": "A local or daemon liveness snapshot requested before a pane binds a PTY cannot prove that newer binding dead or route it through exit teardown.",
      "oracle": "Audit1948: Audit1944 removes the sole narrow reconcile-predicate suite. Timestamp equality, local membership and remote/SSH exclusion examples are accepted lost alarms; the suite does not independently drive a requested-snapshot/late-binding close race. No current automated oracle or validated coverage remains for this gate, and no equivalent replacement is claimed. Historical prior account (preserved verbatim): The decision layer rejects reconciliation when ptyBoundAt is greater than or equal to snapshotRequestedAt, still reconciles genuinely absent older local ids, and treats rejected provider listing as unknown.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Audit1948: Historical observations only after retirement of this gate’s sole current suite and complete dated receipt. No reduced-selector pass, fresh red/green, soak or measured budget is inferred. Historical prior account (preserved verbatim): local unit test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1948: Historical observations only after retirement of this gate’s sole current suite and complete dated receipt. No reduced-selector pass, fresh red/green, soak or measured budget is inferred. Historical prior account (preserved verbatim): Registered after existing targeted tests were found; needs soak history before blocking promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Audit1948: Historical observations only after retirement of this gate’s sole current suite and complete dated receipt. No reduced-selector pass, fresh red/green, soak or measured budget is inferred. Historical prior account (preserved verbatim): Unit tests encode the stale snapshot/newborn race and fail if the freshness guard is removed. Needs saved CI or intentional-break artifact before blocking promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The gate itself is cheap. Any PR changing reconciliation loops, hidden-pane scans, or provider polling must also run a terminal throughput or event-loop-delay measurement before blocking promotion."
      },
      "promotionCriteria": [
        "Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach red/green evidence from the freshness guard regression.",
        "Add an integration/provider-contract follow-up that proves tab survival plus input/output after stale snapshot release."
      ],
      "knownGaps": [
        "Current command asserts the pure decision and orchestration timestamp forwarding, not a full Electron tab-survival/input echo flow.",
        "SSH and remote providers are intentionally unknown-liveness paths and need separate provider-contract gates.",
        "Audit1948: Audit1944 removes the sole narrow reconcile-predicate suite. Timestamp equality, local membership and remote/SSH exclusion examples are accepted lost alarms; the suite does not independently drive a requested-snapshot/late-binding close race. No current automated oracle or validated coverage remains for this gate, and no equivalent replacement is claimed.",
        "Audit1948 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/lifecycle/terminal-dead-session-reconcile.test.ts\",\n          \"assertions\": [\n            \"a newborn pane bound after the snapshot was requested is not reconciled (boundAt >= requestedAt freshness guard)\",\n            \"a rejected listSessions is treated as unknown and reconciles nothing\",\n            \"remote, SSH, and mid-spawn panes are skipped by the reconcile path\",\n            \"targeted liveness probes receive the request timestamp and resolved live-session ids\"\n          ]\n        }",
        "Audit1948 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.5,\n          \"summary\": \"1 test file(s) passed, 17 tests passed on main@1282f5c2d in a clean checkout.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/lifecycle/terminal-dead-session-reconcile.test.ts\"\n        }"
      ],
      "demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
    },
    {
      "id": "terminal-session.shell-owned-mode-recovery",
      "title": "Dead TUI mode recovery requires execution-host shell ownership",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "host-renderer-electron",
      "surfaces": [
        "alternate-screen lifecycle",
        "mouse input routing",
        "hidden-output snapshot restore",
        "daemon reattach",
        "remote-runtime replay",
        "durable terminal history"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local", "daemon", "remote-runtime"],
      "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/16379"],
      "invariant": "After a TUI exits or is killed, reveal, reattach, snapshot replay, or renderer remount must not deliver terminal-owned mouse or alternate-screen protocol bytes to the surviving shell. Recovery is an ordered output barrier in the daemon session data path: an OSC 133;D completing while the alternate screen is still active pauses the stream at that exact byte boundary, a fresh execution-host process inspection proves shell ownership, and on proof a mode reset is injected as in-stream output so every consumer converges by parsing the same bytes and the queued post-boundary shell output (the prompt) lands on the normal buffer. Snapshots are pure reads. Any failure — refuted proof, timeout, queue overflow, session death, disposal — flushes the queue unmodified, preserving incumbent behavior; later command or mode bytes revoke proof. Clean alternate-screen exits prove ownership asynchronously without pausing.",
      "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot",
        "pnpm exec electron-vite build --mode e2e",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts",
        "src/main/daemon/sessions/testing/session-shell-recovery.test.ts",
        "src/main/daemon/sessions/testing/session.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts",
        "src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts",
        "src/main/providers/agent-foreground-process.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/main/runtime/terminal/layout/mobile-presence-lock.test.ts",
        "src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts",
        "src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts",
        "tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
        "tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/daemon/sessions/testing/session-shell-recovery.test.ts",
          "assertions": [
            "post-kill shell output survives into the normalized snapshot instead of the discarded alt buffer",
            "a snapshot taken during a split escape keeps the pending tail intact and stale proof is revoked by the completing bytes"
          ]
        },
        {
          "file": "src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts",
          "assertions": [
            "the pending tail this gate threads over the wire folds identically at every code-unit split of the combined stream, including boundaries landing inside oscEsc/stringEsc",
            "the split sweep runs over an alphabet carrying CAN, SUB, doubled ESC inside OSC/DCS/SOS/PM/APC, BEL, C1 ST, NUL, DEL, intermediates, CJK, astral, and lone surrogates"
          ]
        },
        {
          "file": "tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts",
          "assertions": [
            "normal exit and cleanup-free SIGKILL both restore a visible clean shell marker",
            "renderer logical buffer is normal and mouse tracking is disabled after host-proven recovery",
            "real pointer input writes no SGR mouse report to the surviving shell",
            "an unrelated pane remains live"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-26",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 33.8,
          "summary": "Both normal-exit and SIGKILL journeys passed on the ordered-output-barrier implementation; each asserted renderer and host normal modes, host ownership metadata, exact PTY input, no post-exit SGR mouse report under real pointer input, and unrelated-pane survival, with post-boundary prompt output additionally proven visible on normal exit."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Changed selectors have no new soak result after Audit1320; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic focused suites and two-case Electron journey pass locally; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1320 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The byte-identical Electron journey reproduced screenshot-like numeric mouse-report residue and a real SGR mouse packet reaching the shell before the focused action. With only the renderer's host-proven reset disabled, normal cleanup failed in normal-buffer/any-event mouse state and SIGKILL failed in alternate-buffer/any-event mouse state. Restoring the action made both cases green."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. No reveal timer, polling, periodic scan, broad session inventory, or renderer remount is added, and snapshots perform no writes. The stream pauses only for an unclean alternate-screen death (never for clean TUI exits or ordinary output), bounded by a 750 ms bail timer and a 256 KiB queue cap that both flush unmodified. The event-triggered fresh host inspection measured 30 local macOS samples at 84.6 ms median, 103.7 ms p95, and 124.5 ms maximum; the paired runtime asks the daemon for its settled verdict instead of running a second inspection."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Run the real journey on Linux and Windows, including ConPTY and WSL.",
        "Add headed and headless paired-runtime journey evidence.",
        "Keep missing-proof mixed-version behavior identical to the incumbent client path."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode-2031-subscriptions.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/geometry/pty-connection-visibility-resume-size.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-stale-daemon-snapshot-replay.spec.ts. Intentionally lose these named regression alarms without replacement: catches a subscribed pane up once per mode change across repeated reconnects — Mode2031 theme reporting catch-up/deduplication across repeated reconnects loses this direct protocol example.; defers to the viewer holding the grid, then catches up once on release — Held-grid viewer deferral and one catch-up/current-mode resending on release lose this direct protocol example.; repairs grid drift with a trailing probe when output stops inside the settled interval — A trailing drift probe after the last output frame loses this direct alarm.; skips foreground grid drift repair while mobile owns the PTY without a fit override — Mobile driver ownership suppressing foreground drift repair without override loses this direct alarm.; reports desktop geometry without resizing while a mobile-fit override is active — Desktop geometry reporting without resizing a mobile-owned grid loses this direct alarm.; defers a remote-desktop viewport claim until structural replay completes — Remote-desktop viewport claim waiting for structural replay completion loses this direct alarm.; skips observed desktop reassertion while mobile owns the PTY without a fit override — Observed desktop reassertion suppression under mobile ownership loses this direct alarm.; queues re-asserted resizes while pane resize holds are active — Resize hold release flushing the latest reasserted grid loses this direct alarm.; reasserts a remote grid only when visible (%s) — Visible-only remote grid reassertion loses its visible and hidden examples.; claims a focused visible remote mirror once when its passive fit hold arrives — Focused visible passive mirror claiming once, with unfocused and late repeat suppression, loses this direct sequence alarm.; does NOT re-assert while a mobile-fit override parks the PTY at phone dims — Phone fit hold suppressing visibility-resume PTY reassertion loses this direct alarm.; does NOT forward when the pane is hidden again before getSize resolves (stale hop) — Late size lookup after re-hide refusing a hidden-tab SIGWINCH loses this direct adverse-ordering alarm.; clears the captured pen for a normal-buffer fallback reattach — Fallback normal-buffer reattach clearing captured pen and dirty background loses this direct example.; waits for a recovered destination fit before forwarding its grid or live output — Recovered destination fitting before forwarding grid or live output loses this direct example.; suppresses the deferred reattach grid push when mobile claims the PTY while hidden — Mobile takeover while hidden suppressing deferred reattach grid forwarding loses this direct example.; drops stale callbacks but delivers fresh replacement output after an old replay clear — Fresh replacement output winning over stale callbacks after old replay clear loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot\",\n        \"pnpm exec electron-vite build --mode e2e\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts\",\n        \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n        \"src/main/daemon/sessions/testing/session.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts\",\n        \"src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts\",\n        \"src/main/providers/agent-foreground-process.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/main/runtime/terminal/layout/mobile-presence-lock.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts\",\n        \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n        \"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\",\n        \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n          \"assertions\": [\n            \"post-kill shell output survives into the normalized snapshot instead of the discarded alt buffer\",\n            \"a snapshot taken during a split escape keeps the pending tail intact and stale proof is revoked by the completing bytes\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n          \"assertions\": [\n            \"the pending tail this gate threads over the wire folds identically at every code-unit split of the combined stream, including boundaries landing inside oscEsc/stringEsc\",\n            \"the split sweep runs over an alphabet carrying CAN, SUB, doubled ESC inside OSC/DCS/SOS/PM/APC, BEL, C1 ST, NUL, DEL, intermediates, CJK, astral, and lone surrogates\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\",\n          \"assertions\": [\n            \"normal exit and cleanup-free SIGKILL both restore a visible clean shell marker\",\n            \"renderer logical buffer is normal and mouse tracking is disabled after host-proven recovery\",\n            \"real pointer input writes no SGR mouse report to the surviving shell\",\n            \"an unrelated pane remains live\"\n          ]\n        }\n      ]",
        "Audit3077 deletes the Kitty restore/reset integration suite and its registrar. The input-and-repaint driver remains populated; the retired emission/mirror/host-request alarms have no equivalent replacement.",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope.",
        "Audit3053 reduces hidden-replay coverage by retiring nominal overlap, resize, cursor metadata and standalone stalled-restore variants. Timeout, overflow, identity/generation fences and retained live-output coordination remain; the removed alarms are intentionally lost without equivalent replacement. Existing commands, assertion references and dated evidence retain their original scope.",
        "Audit3037 removes seven supplied-input baseline cases from the terminal-input-gating registrar. Input-and-repaint wrapper selectors and unrelated assertions remain; historical receipts do not validate the reduced source bytes. Pane authority, acknowledgment refusal and quarantine recovery cases remain, without native or RPC execution claims.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "A zero-width injected reset does not advance outputSequence, so the mobile renderer-snapshot stability oracle cannot detect a reset landing inside its serialize round-trip; the resulting tear is transient and self-heals on the next repaint (same exposure as the pre-existing device-attributes release emission).",
        "Bytes the dying command printed before its OSC 133;D (pre-boundary output into the still-active alternate screen, e.g. a final panic line) are discarded with the dead frame; only post-boundary shell output is preserved.",
        "Direct local provider and degraded (daemon-less) sessions get ownership proof and the renderer-side reset, but no in-stream normalization — pre-reveal prompt output is not preserved there.",
        "Visible Electron evidence is macOS-only.",
        "Direct SSH intentionally fails closed to current-main behavior because foreground proof would inherit transport timeout and enumeration ambiguity.",
        "WSL and Windows ConPTY process-membership behavior has no physical-host proof yet.",
        "Any stopped (Ctrl-Z) descendant in the shell's tree refutes the proof, so a suspended unrelated job silently disables recovery for that pane (fails closed to incumbent behavior).",
        "Attach is deliberately settle-free: a viewer connecting inside an in-flight proof (~100ms typical) receives the pre-reset snapshot as its first frame and self-heals when the in-stream reset arrives; snapshot RPC and remote serialize paths still inherit a bounded (750ms) settle wait while a proof is in flight.",
        "Paired headed and headless remote-runtime topologies have not yet run the full pointer-input oracle.",
        "The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage.",
        "Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed.",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1412: src/main/daemon/terminal-host-concurrent-create.test.ts reduced. Loses race deduplication, attach during unsettled ownership proof, retry after failed spawn, distinct-session parallelism, disposal waiting and shutdown retry-fencing alarms bundled with removed internal-call counts or real-time waits. No replacement-equivalence claim. src/main/daemon/terminal-checkpoint-serializer.test.ts reduced. Loses bounded native conversion/no-whole-candidate materialization and snapshot getter single-read alarms. Retained byte-size outcomes do not establish CPU/allocation bounds. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1878 removes only the direct over-cap abandonment example from terminal-partial-escape-tail.test.ts. The unchanged fixed-sequence split/fold sweep is retained; it is not an independent parser oracle or a new execution of the historical 25.6M-case sweep. Its current seventeen sequences do not substantiate the full alphabet inventory described by the older assertion reference. No equivalent replacement coverage or fresh whole-gate execution is claimed.",
        "Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'starts idle for unknown PTY'; 'handleMobileSubscribe in auto mode transitions idle → mobile{clientId}'; 'handleMobileSubscribe in desktop mode is passive — does NOT take floor'; 'reclaimTerminalForDesktop transitions mobile → desktop and is idempotent'; 'mobileTookFloor after reclaim re-applies phone-fit and flips driver back to mobile'; 'restores the pre-write driver after overlapping claims from one phone both fail'; 'keeps a successful overlapping claim as the rollback baseline'; 'does not let an older phone-fit completion retake a newer writer floor'; 'a superseded mobile input %s preserves a newer phone claim'; 'mobile input without an active subscriber cannot create an orphaned floor lock'; 'a %s phone-fit completion after disconnect cannot recreate the mobile lock'; 'admits a soft-leaving client to reserve the input floor within the grace window'; 'handleMobileUnsubscribe last leaver flips driver to idle after soft-leave grace'; 'resubscribe within soft-leave grace cancels idle without driver flap'; 'onPtyExit clears driver state and emits idle'; 'elects one query responder and promotes the survivor on unsubscribe'; 'keeps the earliest subscriber authoritative after a soft-leave resubscribe'; 'excludes an older passive desktop-mode subscriber from reply authority'; 'most-recent actor wins active phone-fit dims (B subscribes after A)'; 'B unsubscribes — A still present, driver re-elects to A'; 'A then B unsubscribes — peer survives; final unsubscribe goes idle'; 'terminal.send by phone-B updates lastActedAt — applyMobileDisplayMode picks B viewport'; 'mobile mode change marks the caller before applying phone-fit'; 'updateMobileViewport re-fits PTY without flipping the driver'; 'updateMobileViewport late-binds a viewport-less mobile subscriber'; 'updateMobileViewport records viewport without applying layout in desktop mode'; 'updateMobileViewport reports applied=false when phone-fit resize fails'; 'updateMobileViewport then disconnect restores PTY to original baseline'; 'legacy unsubscribe → resubscribe within grace preserves baseline (regression)'; 'earliest-subscribe restore target is preserved when peers churn'; 'second Restore click after success returns true with no new resize or fit-override event'; 'driving take-back still converges: driver → desktop, override cleared, both channels notified'; 'held restore with a failing resize still releases and clears the override'; 'active-subscriber take-back with a failing resize still releases the lock'; 'phone-initiated setDisplayMode(desktop) against a stale held override converges'; 'orphan cleanup: reclaim on a held override with no layout entry converges'; 'a still-subscribed phone reporting its viewport does not undo a desktop take-back'; 'a deliberate mobile gesture still re-takes the floor after a desktop take-back'; 'a replayed subscribe after a reconnect does not undo a desktop take-back'; 'a foreground resubscribe inside the soft-leave grace does not undo a desktop take-back'; 'typing on the phone after a reconnect re-takes the floor and phone-fits again'; 'take-back of a held phone-fit with no subscriber also keeps the next subscribe passive'.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts src/main/daemon/sessions/testing/session-shell-recovery.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot\",\n        \"pnpm exec electron-vite build --mode e2e\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/daemon/shell-readiness/testing/terminal-shell-recovery-barrier.test.ts\",\n        \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n        \"src/main/daemon/sessions/testing/session.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-concurrent-create.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"src/main/daemon/history/restoration/testing/daemon-restore-scrollback-depth.test.ts\",\n        \"src/main/daemon/history/restoration/testing/terminal-checkpoint-serializer.test.ts\",\n        \"src/main/providers/agent-foreground-process.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/main/runtime/terminal/layout/mobile-presence-lock.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts\",\n        \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n        \"tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts\",\n        \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/daemon/sessions/testing/session-shell-recovery.test.ts\",\n          \"assertions\": [\n            \"post-kill shell output survives into the normalized snapshot instead of the discarded alt buffer\",\n            \"a snapshot taken during a split escape keeps the pending tail intact and stale proof is revoked by the completing bytes\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts\",\n          \"assertions\": [\n            \"the pending tail this gate threads over the wire folds identically at every code-unit split of the combined stream, including boundaries landing inside oscEsc/stringEsc\",\n            \"the split sweep runs over an alphabet carrying CAN, SUB, doubled ESC inside OSC/DCS/SOS/PM/APC, BEL, C1 ST, NUL, DEL, intermediates, CJK, astral, and lone surrogates\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-hidden-child-tui-kill-mode-reset.spec.ts\",\n          \"assertions\": [\n            \"normal exit and cleanup-free SIGKILL both restore a visible clean shell marker\",\n            \"renderer logical buffer is normal and mouse tracking is disabled after host-proven recovery\",\n            \"real pointer input writes no SGR mouse report to the surviving shell\",\n            \"an unrelated pane remains live\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
      ],
      "demotionRule": "Keep experimental or demote if missing ownership proof changes incumbent behavior, a live TUI loses mouse/focus modes, foreground inspection enters ordinary output/reveal paths, or the focused Electron journey flakes without an identified product or harness fault."
    },
    {
      "id": "terminal-session.layout-pty-ownership",
      "title": "Restored terminal layouts retain one renderer owner per PTY",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "renderer-electron-restore",
      "surfaces": [
        "persisted terminal layout restore",
        "daemon PTY reattach",
        "terminal tab hide and reveal",
        "xterm renderer ownership",
        "remote terminal layout mirroring"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "local-daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local-daemon"],
      "coverageNotes": "Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Component unit tests cover persisted replay, rootless layouts, repeated leaf ids, metadata repair, and 12,000 nested duplicate leaves; retained store tests cover live/future pane-authority transfer and a prior detach destination. A two-launch macOS Electron journey covers a real surviving local-daemon PTY, persisted duplicate ownership, synchronized streaming output, and tab hide/reveal. Live Linux, Windows, SSH, WSL, and remote-runtime restore journeys remain gaps. The audit removed a mocked duplicate-replay wrapper suite. Its callback-count alarms are no longer covered here; retained ownership tests and historical Electron evidence do not establish equivalent wrapper coverage. The broad mirror fixture no longer supplies the duplicate-remote-PTY assertion referenced here. The terminal-mirroring fixture also lost its separate duplicate-PTY example and now retains host-finalized pending-binding composition only. Duplicate-PTY and topology fixture alarms are lost; remaining gate evidence is not replacement coverage. The test-value audit removed store duplicate/layout-only, hydration, legacy-leaf, and cross-tab layout-state examples. Their direct normalization, hydration authority, legacy compatibility, and cross-tab preservation alarms are lost. The retained store cases exercise live/future authority transfer and a prior detach destination; component and historical Electron evidence do not establish equivalent replacement coverage.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11757",
        "https://github.com/stablyai/orca/pull/11726"
      ],
      "invariant": "Within one terminal tab, each PTY has at most one layout leaf, pane manager surface, and xterm renderer owner. Restore and remote mirroring must normalize duplicate ownership before replay while retaining active-leaf focus, scrollback, pane authority, agent metadata, and distinct sibling PTYs.",
      "oracle": "Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Launch Orca with a real daemon PTY running a synchronized full-screen stream, close the desktop client without killing the daemon process, seed the persisted tab layout with two leaves bound to that PTY, and relaunch. Hide the restored tab behind a sibling and reveal it, then require the stream to remain visible with exactly one manager pane, one xterm DOM node, one root leaf, one PTY binding, and one unique PTY. Component contracts cover persisted replay, rootless and repeated-leaf layouts, metadata repair, and deeply nested input. Retained store contracts cover live/future authority transfer onto a retained leaf and preservation of a prior detach destination.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts --reporter=dot",
        "pnpm exec electron-vite build --mode e2e",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts",
        "src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts",
        "src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts",
        "tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/shared/workspace-layout/terminal-layout-pty-ownership-depth.test.ts",
          "assertions": ["prunes deeply nested duplicate ownership without recursive stack growth"]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/layout/terminal-layout-pty-ownership.test.ts",
          "assertions": [
            "keeps the active leaf and prunes the stale surface plus its metadata",
            "is idempotent and preserves one owner across PTY and focus permutations"
          ]
        },
        {
          "file": "src/renderer/src/store/terminals/terminal-layout-pty-ownership.test.ts",
          "assertions": [
            "moves live and future pane authority onto the retained PTY leaf",
            "does not steal authority from a pane that was already detached to another tab"
          ]
        },
        {
          "file": "tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts",
          "assertions": ["repairs duplicate persisted PTY renderers before streaming tab reveal"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-01",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 8.7,
          "summary": "The two-launch Electron journey preserved one real daemon PTY and one renderer through duplicate-layout repair and post-relaunch tab reveal.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "focused ownership unit suite plus one prebuilt two-launch Electron journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic unit and Electron gates pass locally on macOS; focused CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Orca 1.4.161 visibly strands and fragments the synchronized stream after restoring duplicate PTY renderers (https://github.com/user-attachments/assets/6917ac6f-9ba3-4f6f-a082-fb62932d511f). The post-resize capture remains corrupted, with duplicated lower rows and the terminal still stranded on the right; it is not recovery evidence (https://github.com/user-attachments/assets/32f7be79-0919-48c2-bcad-e4b7f1e14f2d). After the #11726 ownership repair, the equivalent stream remains continuous in one full-width renderer (https://github.com/user-attachments/assets/8c9cc5a2-dbe3-4348-b05c-f8268b98c476), and the final automated journey reports one owner at every layer after relaunch and tab reveal (https://github.com/user-attachments/assets/f19b46aa-e56f-476c-9e2c-e4c3a784c805)."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Ownership normalization is bounded by layout size, uses iterative traversal, and passes a 12,000-leaf duplicate layout without recursive stack growth. The follow-up adds no production polling, renderer work, listeners, persistence scans, or retained payloads."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Run the live two-launch journey on Linux and Windows.",
        "Add live SSH or remote-runtime duplicate-restore evidence before claiming provider-complete coverage."
      ],
      "knownGaps": [
        "Live Electron evidence currently covers macOS with a local daemon PTY only.",
        "The live journey uses a git-backed test workspace; folder-workspace restoration currently relies on the same provider-independent normalization contracts rather than a separate Electron run.",
        "The gate deterministically seeds the historical persisted-state shape; it does not depend on reproducing the unknown UI sequence that originally wrote duplicate ownership.",
        "The visual old-release evidence and the structural current-version oracle are separate runs because the current test harness did not exist in Orca 1.4.161.",
        "The audit removed a mocked duplicate-replay wrapper suite. Its callback-count alarms are no longer covered here; retained ownership tests and historical Electron evidence do not establish equivalent wrapper coverage.",
        "The broad mirror fixture no longer supplies the duplicate-remote-PTY assertion referenced here. The terminal-mirroring fixture also lost its separate duplicate-PTY example and now retains host-finalized pending-binding composition only. Duplicate-PTY and topology fixture alarms are lost; remaining gate evidence is not replacement coverage.",
        "The test-value audit removed store duplicate/layout-only, hydration, legacy-leaf, and cross-tab layout-state examples. Their direct normalization, hydration authority, legacy compatibility, and cross-tab preservation alarms are lost. The retained store cases exercise live/future authority transfer and a prior detach destination; component and historical Electron evidence do not establish equivalent replacement coverage.",
        "Audit1925 (sources1922/1923): Partial ownership suite loses fixed first-leaf/rootless/dangling-selection/idempotence/identity examples. Both existing active assertion aliases stay backed by exact retained active-leaf metadata pruning and idempotence across PTY/focus permutation callbacks; metadata collision and repeated-leaf challenges survive. No deleted fixed example is assigned replacement coverage. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'keeps the first layout leaf when focus belongs to another PTY'; 'repairs rootless duplicate ownership in one idempotent pass'; 'repairs dangling rooted selection during direct ownership normalization'; 'preserves PTY ownership while collapsing repeated live leaf ids'; 'preserves valid split layouts by identity'."
      ],
      "demotionRule": "Keep experimental or demote if ownership cardinality flakes, duplicate replay reaches a second renderer, active metadata or authority moves to the wrong leaf, deep normalization regresses, or a supported provider bypasses normalization."
    },
    {
      "id": "terminal-session.split-activation-ordering",
      "title": "Terminal splits activate before inherited-CWD lookup settles",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-renderer-lifecycle",
      "layer": "renderer-unit-and-local-transport",
      "surfaces": [
        "terminal pane split",
        "inherited working directory",
        "pre-connect terminal input",
        "split close cleanup",
        "pre-bind pane detach"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "local-daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the complete mocked inherited-CWD split orchestration suite: local/server delegation, async CWD forwarding, stale-manager refusal, nested lookup reuse and layout-owner call-argument/no-call alarms are lost; no real pane/PTY/remote split ran. The partial CWD resolver loses supplied OSC7/cache/remote-ID/deferred-field and stale-cleanup examples, so its entire three-title deferred-fence assertion object retires. Its actual timer admission/fallback callbacks remain selected. Handoff loses simple promise/input projection, direct clear and direct discard-as-restored-PTY samples; retire only that projection title while retaining stale-owner handoff, released-owner/input limits, eviction and expiry mappings. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer contracts hold CWD resolution behind an explicit promise, require the new pane to be created synchronously, and prove that close cancels the pending connection. A module-level stable-pane-key handoff preserves the exact CWD promise and bounded pre-connect input across whole-tab remounts, including a tab rehome between worktree buckets; stale owners are fenced, concrete PTY bind and definitive spawn failure clear the record, and explicit pane close discards it. Detach contracts reject cwd-pending and cwd-resolved deferred splits before PTY bind without mutation, carry resolved cwd for other unbound panes, and preserve persisted or live PTY handoff. Local IPC transport contracts exercise the real bounded pre-connect buffer and one live input FIFO across seeded and newly typed ordinary, acknowledged, and immediate writes, concurrent flushes, in-flight teardown, late spawn success or failure, attach failure, failed spawn, same-id reuse, stale-spawn retirement ownership, destroy, and mutable recovery metadata. The handoff registry is capped at 64 records for 15 seconds and shares the existing 1,024-entry/conservative UTF-16 input ceilings. A mocked direct-SSH authority-rotation contract proves a rejected stale spawn releases its deferred-CWD fence. The schema-v2 headful Electron benchmark records exact revision identity and attributes CWD request/settlement, PTY spawn request/result, bind, fixture unlock request/IPC write, fixture readiness, input, and first echo across 3 warmups and 20 measured cold-CWD cycles, requiring a distinct child PTY and observed child pty:exit before the next cycle. Remote-runtime coverage proves delegation remains host-owned; its host-delegated split path does not consume the local pre-connect input options, so remote-runtime input-remount replay and physical local-daemon, SSH, WSL, Linux, Windows, and folder-workspace latency journeys remain gaps. The test-value audit retires the benchmark artifact and report unit suites. Their direct JSON write/readback, unwritable-path, path-redaction/string-bound, synthetic phase-attribution, revision/percentile and missing-unlock-event alarms are lost. The real benchmark and its capture/report/writer helpers remain; they do not provide equivalent isolated helper validation. Historical executed commands, counts and results remain historical. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts reduced. Happy inherited-cwd wait and transport-option forwarding sample loses its individual alarm. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/commit/572ed1a8882"],
      "invariant": "A terminal split creates and activates its renderer pane before an inherited-CWD lookup settles, starts its PTY only after the resolved directory is available, and cannot be externally detached while that deferred spawn remains unbound. A whole-tab remount or worktree rehome preserves the same stable pane's CWD promise and admitted local pre-connect bytes in order until a successor binds or the intent is definitively abandoned; stale owners cannot append or clear the successor's record. Other unbound panes preserve resolved cwd as startupCwd when detached. Bounded pre-connect input and later live local input share byte order, and teardown settles acknowledged writes without creating or rebinding a stale PTY. A disconnected or detached pending connect cannot bind its late fresh spawn, report its late failure through current callbacks, or ID-retire a newer same-ID owner; rejecting a stale direct-SSH spawn also releases the matching deferred-CWD fence. Natural exit cannot deliver queued work into a reused PTY id. Bound and remote-runtime splits remain owned by their execution host.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the complete mocked inherited-CWD split orchestration suite: local/server delegation, async CWD forwarding, stale-manager refusal, nested lookup reuse and layout-owner call-argument/no-call alarms are lost; no real pane/PTY/remote split ran. The partial CWD resolver loses supplied OSC7/cache/remote-ID/deferred-field and stale-cleanup examples, so its entire three-title deferred-fence assertion object retires. Its actual timer admission/fallback callbacks remain selected. Handoff loses simple promise/input projection, direct clear and direct discard-as-restored-PTY samples; retire only that projection title while retaining stale-owner handoff, released-owner/input limits, eviction and expiry mappings. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Hold CWD resolution behind a controllable promise, invoke the production split path, and require manager.splitPane plus split telemetry before resolving it. Before PTY bind, require both cwd-pending and cwd-resolved deferred detach attempts to return null without layout, pane, tab, ownership, or focus mutation; separately require resolved cwd on an allowed unbound detach and unchanged persisted/live PTY adoption. Exercise the stable-pane handoff registry through repeated remounts and a worktree rehome, requiring the identical CWD promise, ordered ordinary/acknowledged/immediate seed replay, stale-owner fencing, 64-record/15-second bounds, and discard on bind, failure, or explicit close. Rotate a mocked direct-SSH authority while its delayed spawn is in flight, reject and disconnect the stale PTY claim, then require exactly one deferred-CWD cleanup when the delayed connect settles. At the local IPC PTY boundary, require zero connect calls while pending, the resolved CWD in spawn and local recovery metadata, one shared FIFO across seeded/new pre-connect and live ordinary/acknowledged/immediate input, prompt predecessor acknowledged-promise settlement on teardown, retirement of an unowned late fresh spawn, preservation of a newer same-ID owner, and zero stale delivery after failure, close, destroy, detach, natural exit, or same-id reuse. Capture callback exceptions must not change admission results. In visible Electron, press the real split shortcut for 3 warmup cycles, then after a cold inherited-CWD interval for each of 20 measured cycles, require an exact clean revision identity, complete focus/CWD/spawn/bind/fixture/input/echo attribution, distinct child PTYs, pane count, and child exits for every cycle; a timed-out, missing-event, or cleanup-aborted run must publish no headline latency and fail.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "evidenceProcedure": "Run the benchmark spec in a visible macOS Electron project from a clean primary worktree, complete 3 warmups followed by 20 measured cold-CWD cycles, require zero missing events and successful cleanup, save the schema-v2 JSON report, and record its SHA-256 plus embedded revision identity. The four older records are schema-v1 historical audit records whose labels do not verify the checkout or include phase attribution; the clean schema-v2 record is the current candidate evidence. A paired baseline/final rerun with one revision-verifying harness remains required before promotion or a readiness comparison claim.",
      "runtimeBudget": {
        "p95Seconds": 240,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The focused promise-barrier, remount-handoff, benchmark-artifact, and schema-v2 attribution suite passes locally in 99 tests; the clean visible benchmark passes 3/3 warmups and 20/20 measured cycles with zero missing events. Its first attempt hit a transient warmup cleanup-dialog click timeout, then the exact command passed on retry without a launch, profile, or port workaround. Routed CI and soak history have not started. Historical benchmark labels do not verify the product checkout or embed revision identity."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Before the production seam landed, the split assertion failed with zero manager calls while CWD was pending, and the transport assertion rejected the first pre-connect input. Before the detach fence, a deferred split could be removed after CWD resolved but before PTY bind, dropping its pre-connect input. Before the single-flight hardening, the concurrent-flush oracle delivered ordinary input before the earlier acknowledged write and clear left the in-flight promise pending. Before stale-spawn ownership fencing, the combined deferred-connect and newer same-ID attach fixture called kill on the current PTY. An intentional one-line revert of deferred-CWD cleanup in the stale direct-SSH claim branch failed its focused callback assertion with zero calls instead of one; restoring it passed the prior focused tests. The remount-handoff, transport, artifact-write, and schema-v2 attribution regressions are green in the 99-test twelve-path run, but isolated intentional-revert evidence for each cleanup branch remains outstanding."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Pane creation and focus add no timer, polling, provider inventory, or subprocess work. CWD resolution remains one existing bounded request off the visible activation path, and detach admission adds only bounded map and record lookups. The remount handoff adds one module-level map lookup per pane lifecycle, a 64-record cap, and a 15-second expiry; it retains no unbounded payload. Pre-connect input, including an in-flight acknowledged write and remount seed replay, is capped at 1,024 entries and a conservative UTF-16 ceiling derived from the existing terminal-input byte limit, drains through one worker in order, and clears on teardown or failed connect. The historical schema-v1 same-mode pair recorded shortcut-to-focus p50/p95/max changing from 65.7/88.7/102.6 ms to 12.8/14.4/16.5 ms; those labels do not embed revision identity, so the comparison is directional evidence only. The clean schema-v2 candidate attributes focus at 12.0/13.6/14.7 ms while CWD lookup takes 40/97/103 ms and spawn request-to-result takes 48/120/122 ms, demonstrating that provider/process startup follows activation rather than blocking it. In that clean run, shortcut-to-bind is 113.5/161.3/162.7 ms, fixture IPC-write-to-ready is 35.1/87.4/141.8 ms, and input-to-echo is 1.3/3.5/3.9 ms; these readiness phases are diagnostic, one-host descriptive measurements, and no clean schema-v2 baseline exists to support a readiness improvement or regression claim. The n=20 empirical p95 values are descriptive, are not a distribution guarantee, and are not CI-enforced."
      },
      "promotionCriteria": [
        "Record complete red/green evidence for close, remount/rehome handoff, mixed-input ordering, metadata, and failure cleanup.",
        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake.",
        "Run the committed real-shortcut Electron benchmark in routed CI or soak before enforcing a latency budget.",
        "Collect physical local-daemon, SSH or WSL plus Linux, Windows, and folder-workspace evidence before claiming provider-complete coverage."
      ],
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts are retired below as historical raw objects; their counts do not validate reduced commands. Retired active assertionRefs (raw original objects retained as historical only): {\n          \"file\": \"tests/e2e/terminal-split-activation-latency-main-probe.ts\",\n          \"assertions\": [\n            \"attributes CWD and PTY spawn request/settlement events to the source and child PTYs\",\n            \"captures the fixture unlock carriage return on both ordinary and acknowledged IPC channels\",\n            \"restores the intercepted IPC handlers and listener when the probe is disposed\"\n          ]\n        }\n{\n          \"file\": \"tests/e2e/terminal-split-activation-latency-phases.ts\",\n          \"assertions\": [\n            \"merges main-process events by operation and PTY identity without cross-cycle attribution\",\n            \"requires every activation, fixture, input, echo, pane, PTY, and cleanup observation for success\",\n            \"reports each attributed phase distribution with non-negative cross-clock durations\"\n          ]\n        }\n{\n          \"file\": \"tests/e2e/terminal-split-activation-latency.spec.ts\",\n          \"assertions\": [\n            \"requires a visible BrowserWindow and visible document before sampling\",\n            \"records schema-v2 revision identity plus attributed CWD, spawn, bind, fixture-ready, input, and echo phases\",\n            \"records 3 warmups, then 20 measured real-shortcut cycles after cold inherited-CWD intervals\",\n            \"requires every split to focus, bind a PTY distinct from its source, and echo immediate input\",\n            \"observes each closed child PTY exit before starting the next cycle\",\n            \"publishes headline latency only for a fully successful 3-warmup/20-measured run\"\n          ]\n        } All 5 affected passing receipts are retired, so protection becomes none pending a fresh run. Original current selectors and assertion inventory, preserved as historical data only: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/layout/split/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/pty-transport/input/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts tests/e2e/terminal-split-activation-latency-main-probe.ts tests/e2e/terminal-split-activation-latency-phases.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/layout/split/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/pty-transport/input/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/layout/split/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/pty-transport/input/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts --reporter=dot\",\"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=baseline-df14d1a2983d8339e788d0e521f1c4affd9c6d5f-headful-run1 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-baseline-df14d1a2983d8339e788d0e521f1c4affd9c6d5f-headful-run1.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-d453ffcdb704764daced1b2917fddee7224389f0-headful-run2 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-candidate-d453ffcdb704764daced1b2917fddee7224389f0-headful-run2.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-962faacec8c-headful-current ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-962faacec8c-headful.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-962faacec8c-headful-run2 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-962faacec8c-headful-run2.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-073e6c7b0eb-headful-clean ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-073e6c7b0eb-headful-clean.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"],\"testFiles\":[\"src/renderer/src/components/terminal-pane/layout/split/resolve-split-cwd.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-split-cwd-resolution.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/input/pty-preconnect-input-buffer.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts\",\"src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts\",\"tests/e2e/terminal-split-activation-latency-main-probe.ts\",\"tests/e2e/terminal-split-activation-latency-phases.ts\",\"tests/e2e/terminal-split-activation-latency.spec.ts\"],\"assertionRefs\":[{\"file\":\"src/renderer/src/components/terminal-pane/pty-transport/input/pty-preconnect-input-buffer.test.ts\",\"assertions\":[\"concurrent flush calls share one worker and preserve mixed input order\",\"clear settles an in-flight acknowledged write before its late resolve or reject\",\"in-flight acknowledged input remains charged to entry and code-unit caps\"]},{\"file\":\"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts\",\"assertions\":[\"ordinary, acknowledged, and immediate pre-connect input flushes in byte order\",\"pending acknowledged input settles on connect, destroy, and spawn failure\",\"disconnect, destroy, and natural exit cancel an in-flight acknowledged write without blocking connect\",\"live acknowledged input blocks later ordinary and immediate writes at its invocation position\",\"the preconnect-to-live transition preserves the same input FIFO\",\"disconnect and detach retire a late fresh spawn and suppress late failures before they reach current callbacks\",\"natural exit fences queued ordinary and acknowledged chunks across same-id reuse\",\"buffered exit and attach failure clear retained input\",\"ordinary and acknowledged write failures drop later input without leaving promises pending\",\"entry and code-unit ceilings bound pre-connect input retention\",\"local recovery metadata observes the resolved split CWD\",\"a stale fresh-spawn completion cannot retire a newer same-ID owner\"]},{\"file\":\"src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts\",\"assertions\":[\"keeps input across repeated remounts and fences stale owners\",\"releases an unmounted owner without dropping its pending handoff\",\"retains input within the shared preconnect entry and code-unit caps\",\"evicts the oldest handoff when the record cap is reached\",\"expires an abandoned handoff after the bounded remount window\"]},{\"file\":\"tests/e2e/terminal-split-activation-latency-main-probe.ts\",\"assertions\":[\"attributes CWD and PTY spawn request/settlement events to the source and child PTYs\",\"captures the fixture unlock carriage return on both ordinary and acknowledged IPC channels\",\"restores the intercepted IPC handlers and listener when the probe is disposed\"]},{\"file\":\"tests/e2e/terminal-split-activation-latency-phases.ts\",\"assertions\":[\"merges main-process events by operation and PTY identity without cross-cycle attribution\",\"requires every activation, fixture, input, echo, pane, PTY, and cleanup observation for success\",\"reports each attributed phase distribution with non-negative cross-clock durations\"]},{\"file\":\"tests/e2e/terminal-split-activation-latency.spec.ts\",\"assertions\":[\"requires a visible BrowserWindow and visible document before sampling\",\"records schema-v2 revision identity plus attributed CWD, spawn, bind, fixture-ready, input, and echo phases\",\"records 3 warmups, then 20 measured real-shortcut cycles after cold inherited-CWD intervals\",\"requires every split to focus, bind a PTY distinct from its source, and echo immediate input\",\"observes each closed child PTY exit before starting the next cycle\",\"publishes headline latency only for a fully successful 3-warmup/20-measured run\"]}],\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"remote-runtime\"]}. No claim that retained test bodies disappeared. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=baseline-df14d1a2983d8339e788d0e521f1c4affd9c6d5f-headful-run1 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-baseline-df14d1a2983d8339e788d0e521f1c4affd9c6d5f-headful-run1.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n          \"durationSeconds\": 72,\n          \"summary\": \"At baseline df14d1a2983d8339e788d0e521f1c4affd9c6d5f, the visible BrowserWindow and document completed 3/3 warmups followed by 20/20 measured cold-CWD cycles with every event present, distinct child PTYs, and observed child exits. Shortcut-to-focus p50/p95/max was 65.7/88.7/102.6 ms, PTY bind was 122.8/154.0/159.7 ms, and first echo was 203.8/264.2/332.7 ms. Artifact SHA-256: 6d860cd0cd210f55f2349a197318248af488042117b20c08b6831160950c3277.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-d453ffcdb704764daced1b2917fddee7224389f0-headful-run2 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-candidate-d453ffcdb704764daced1b2917fddee7224389f0-headful-run2.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n          \"durationSeconds\": 72,\n          \"summary\": \"At candidate d453ffcdb704764daced1b2917fddee7224389f0, the visible BrowserWindow and document completed 3/3 warmups followed by 20/20 measured cold-CWD cycles with every event present, distinct child PTYs, and observed child exits. Shortcut-to-focus p50/p95/max was 12.8/14.4/16.5 ms, PTY bind was 177.0/316.1/333.3 ms, and first echo was 268.6/627.4/710.7 ms. Artifact SHA-256: 9aef7fa842c732eb74f0066a77b2a0336e8f956a06ca61387f9999d6e76213cc.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-962faacec8c-headful-current ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-962faacec8c-headful.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n          \"durationSeconds\": 72,\n          \"summary\": \"At exact HEAD 962faacec8c, the visible BrowserWindow and document completed 3/3 warmups followed by 20/20 measured cold-CWD cycles with every event present, distinct child PTYs, and observed child exits. Shortcut-to-focus p50/p95/max was 12.6/13.7/13.7 ms, PTY bind was 140.5/399.1/464.1 ms, and first echo was 192.0/519.3/2343.1 ms. Artifact SHA-256: 875e9d37dc711472a81438e4bbdbc8cbc7aada8c961d14195c024d8da350b9e2.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-962faacec8c-headful-run2 ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-962faacec8c-headful-run2.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n          \"durationSeconds\": 72,\n          \"summary\": \"At exact HEAD 962faacec8c, the visible BrowserWindow and document completed 3/3 warmups followed by 20/20 measured cold-CWD cycles with every event present, distinct child PTYs, and observed child exits. Shortcut-to-focus p50/p95/max was 12.8/14.0/14.3 ms, PTY bind was 236.5/654.0/687.3 ms, and first echo was 566.8/1191.5/1219.7 ms. Artifact SHA-256: 4f66b93e5c936ade05f880010f4ec027385d5c89893430169af91c7fdfbe1d06.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_TERMINAL_SPLIT_LATENCY_BENCH=1 ORCA_TERMINAL_SPLIT_LATENCY_LABEL=candidate-073e6c7b0eb-headful-clean ORCA_TERMINAL_SPLIT_LATENCY_OUTPUT=/private/tmp/orca-terminal-split-activation-073e6c7b0eb-headful-clean.json pnpm exec playwright test tests/e2e/terminal-split-activation-latency.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n          \"durationSeconds\": 87.6,\n          \"summary\": \"At exact clean HEAD 073e6c7b0eb1c0ccbb115db1528b641901997c73, the schema-v2 artifact records dirty=false, a visible BrowserWindow/document, and 3/3 warmups plus 20/20 measured cycles with every missing-event counter at zero, distinct child PTYs, and observed child exits. Measured focus p50/p95/max was 12.0/13.6/14.7 ms; attributed CWD lookup was 40/97/103 ms, CWD-settle to spawn request 1/4/4 ms, spawn request to result 48/120/122 ms, and spawn result to bind 2.1/2.5/2.5 ms. Fixture unlock request to IPC write was 0.5/0.8/0.9 ms, IPC write to fixture-ready parse was 35.1/87.4/141.8 ms, and input to first echo was 1.3/3.5/3.9 ms. Total shortcut-to-bind was 113.5/161.3/162.7 ms and shortcut-to-first-echo was 158.5/240.7/291.2 ms. Artifact SHA-256: 1e7ff9e658b717056273d64ecdf662cc6b5776bb6dae1827ed213b7647e4a5fb.\"\n        }",
        "The clean schema-v2 candidate run and the historical schema-v1 comparison records ran on one Apple-silicon macOS host with a synthetic POSIX echo shell and a git-backed workspace; their n=20 empirical p95 values are descriptive and not CI-enforced.",
        "No physical local-daemon, SSH, WSL, Linux, Windows, or folder-workspace latency journey has run; the synthetic fixture is currently skipped on Windows because it requires a POSIX shell.",
        "Remote-runtime split creation remains host-delegated and its transport does not consume the local pre-connect seed/capture options; CWD handoff is covered, but remote-runtime pre-connect input replay has no implementation or evidence.",
        "The four stored schema-v1 artifacts predate the final harness attribution/reporting and do not embed revision identity; the clean schema-v2 candidate artifact is revision-verified, but both product revisions still need a paired schema-v2 rerun with one committed harness before promotion.",
        "No forced-failure visible benchmark artifact has been recorded. The audit removed the focused artifact-write and missing-event report contracts, so neither their isolated failure handling nor full-run failure-report serialization has current verification here.",
        "No clean schema-v2 baseline phase artifact exists, so the attributed CWD, spawn, fixture-ready, bind, and echo timings diagnose where time is spent but do not establish a shell-readiness improvement or regression.",
        "The audit removed a fake-DOM split/close suite. Its mocked focus, scroll, fit and WebGL alarms lose dedicated checks; surviving tests and historical runs do not establish equivalent coverage. Historical commands retain executed roots, while currentCommand maps surviving roots without claiming a new run.",
        "The test-value audit retires the benchmark artifact and report unit suites. Their direct JSON write/readback, unwritable-path, path-redaction/string-bound, synthetic phase-attribution, revision/percentile and missing-unlock-event alarms are lost. The real benchmark and its capture/report/writer helpers remain; they do not provide equivalent isolated helper validation. Historical executed commands, counts and results remain historical.",
        "Audit1342: src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts reduced. Happy inherited-cwd wait and transport-option forwarding sample loses its individual alarm. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/lib/pane-manager/pane-split-close.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts --reporter=dot\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts --reporter=dot\",\n          \"durationSeconds\": 56.59,\n          \"summary\": \"Seven focused files and 78 tests passed. Vitest reported 49.92 seconds and the measured wall time was 56.59 seconds; coverage includes split creation and focus ordering, nested CWD lineage, promise-identity and SSH authority-rotation cleanup fencing, full pre-bind detach fencing, resolved-CWD detach handoff, close-cancellation, single-FIFO ordering, late-spawn retirement and error suppression, preservation of a newer same-ID owner, generation fencing, in-flight settlement across explicit teardown and natural exit, attach cleanup, bounded retention, and existing input-write contracts.\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/lib/pane-manager/pane-split-close.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts --reporter=dot\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts --reporter=dot\",\n          \"durationSeconds\": 44.43,\n          \"summary\": \"Nine focused files and 96 tests passed. Vitest reported 37.78 seconds and measured wall time was 44.43 seconds; the run adds stable-pane CWD/input handoff, repeated-remount stale-owner fencing, bounded 64-record/15-second retention, seeded-input caps, ordered ordinary/acknowledged/immediate replay, predecessor acknowledged-promise settlement, capture-callback failure containment, and benchmark-artifact write-failure coverage to the existing split, detach, CWD, and local transport contracts.\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/lib/pane-manager/pane-split-close.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts tests/e2e/terminal-split-activation-latency-main-probe.ts tests/e2e/terminal-split-activation-latency-phases.ts tests/e2e/terminal-split-activation-latency-report.unit.test.ts --reporter=dot\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts tests/e2e/terminal-split-activation-latency-main-probe.ts tests/e2e/terminal-split-activation-latency-phases.ts --reporter=dot\",\n          \"durationSeconds\": 4.14,\n          \"summary\": \"The updated twelve-path focused command passed 99 tests (10 runnable test files plus 2 benchmark support modules), including schema-v2 main-process phase attribution, report revision identity, fixture IPC-write validation, stable-pane handoff, ordered pre-connect/live input, cleanup, detach, failure, and same-ID ownership contracts.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts\",\n    \"assertions\": [\n      \"starts no PTY connection before inherited CWD resolves\",\n      \"applies the resolved directory to transport options\",\n      \"disposing the split before resolution cancels the pending spawn\",\n      \"invokes deferred-CWD cleanup exactly once after an authority-rotated direct-SSH spawn is disconnected and its delayed connect settles\"\n    ]\n  }\n]",
        "Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Exact lost direct alarms: 'moves chat mode only with its owning leaf %s'; 'creates a new terminal tab with the detached leaf layout and PTY id'; 'preserves the moved PTY shell override when the source uses %s'; 'syncs PTY ownership when the primary source pane is detached'; 'names the new tab as the client that already drew it did'; 'reports a refused move as a toast only for %s'; 'moves the detached tab into the requested group slot'; 'uses the live transport PTY id when the snapshot has not persisted it yet'; 'rejects a deferred split while inherited cwd is pending'; 'rejects a pending cwd even when the deferred marker is absent'; 'still rejects a deferred split after cwd resolves but before PTY bind'; 'carries resolved cwd when detaching an unbound non-deferred pane'; 'finds a same-worktree tab strip under overlay elements'; 'resolves the insertion slot from the hovered tab side'; 'ignores strips from another worktree'.",
        "Audit1903 historical retired assertion inventory; these are not current validated assertions. Complete original raw assertion objects follow verbatim:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/layout/detach/terminal-pane-tab-detach.test.ts\",\n          \"assertions\": [\n            \"rejects a deferred split while inherited CWD is pending without mutation\",\n            \"continues rejecting after CWD resolves until PTY bind\",\n            \"carries resolved CWD as startupCwd for an allowed unbound detach\",\n            \"preserves persisted and live remote PTY detach handoff\"\n          ]\n        }",
        "Audit1925 (sources1922/1923): Delete the complete mocked inherited-CWD split orchestration suite: local/server delegation, async CWD forwarding, stale-manager refusal, nested lookup reuse and layout-owner call-argument/no-call alarms are lost; no real pane/PTY/remote split ran. The partial CWD resolver loses supplied OSC7/cache/remote-ID/deferred-field and stale-cleanup examples, so its entire three-title deferred-fence assertion object retires. Its actual timer admission/fallback callbacks remain selected. Handoff loses simple promise/input projection, direct clear and direct discard-as-restored-PTY samples; retire only that projection title while retaining stale-owner handoff, released-owner/input limits, eviction and expiry mappings. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'hands the same cwd promise and buffered input to a remounted leaf in order'; 'clears the current owner'; 'drops a stale record when an authoritative restored PTY wins the key'; 'returns the confirmed OSC 7 entry without calling IPC'; 'falls through to the unconfirmed cached entry when IPC returns empty'; 'skips local PTY IPC for remote runtime PTY ids'; 'preserves a deferred split fence until the PTY binds'; 'keeps a newer pending deferred lookup when an older callback arrives'; 'splits on the server from the terminal the server published for it'; 'refuses rather than splitting here with %s'; 'delegates remote %s splits without creating a competing local pane'; 'keeps the existing local split-and-focus path unchanged'; 'creates and records the split before asynchronous cwd resolution settles'; 'reuses one pending cwd lookup across rapid nested splits'; 'does not resolve cwd or split a stale manager when the live manager is gone'; 'never asks main in a window-owned build'; 'in a layout-owner build, asks main to split and start the pane, and leaves drawing it to main’s frame'; 'in a layout-owner build, splits here when main answers as today'; 'in a layout-owner build, splits as today where a paired server owns the layout'; 'in a layout-owner build, leaves a handle-less pane’s split to the server whose frames draw it'.",
        "Audit1925 historical original assertion object, preserved verbatim; removed aliases are retired, any surviving aliases remain limited to unchanged retained callbacks:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/layout/split/terminal-pane-split-with-inherited-cwd.test.ts\",\n          \"assertions\": [\n            \"creates and records the split before pending CWD resolution\",\n            \"passes the resolved CWD promise without reviving a stale manager\",\n            \"rapid nested splits reuse one pending CWD lookup\",\n            \"keeps remote-runtime split ownership on its execution host\"\n          ]\n        }",
        "Audit1925 historical original assertion object, preserved verbatim; removed aliases are retired, any surviving aliases remain limited to unchanged retained callbacks:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/layout/split/resolve-split-cwd.test.ts\",\n          \"assertions\": [\n            \"preserves a deferred split fence when OSC 7 updates cwd\",\n            \"clears a settled deferred entry only for matching promise identity\",\n            \"keeps a newer deferred lookup when an older cleanup callback arrives\"\n          ]\n        }",
        "Audit1925 historical original assertion object, preserved verbatim; removed aliases are retired, any surviving aliases remain limited to unchanged retained callbacks:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/layout/split/deferred-split-pane-handoff.test.ts\",\n          \"assertions\": [\n            \"hands the same cwd promise and buffered input to a remounted leaf in order\",\n            \"keeps input across repeated remounts and fences stale owners\",\n            \"releases an unmounted owner without dropping its pending handoff\",\n            \"retains input within the shared preconnect entry and code-unit caps\",\n            \"evicts the oldest handoff when the record cap is reached\",\n            \"expires an abandoned handoff after the bounded remount window\"\n          ]\n        }"
      ],
      "demotionRule": "Keep experimental or demote if pane activation waits on CWD, a deferred split can detach before PTY bind, a remount or rehome loses its stable CWD/input handoff, stale owners mutate a successor record, detached cwd is lost, input reorders or remains pending after cleanup, a closed pane can spawn, stale retirement kills a newer same-ID owner, remote-runtime delegation creates a competing local pane, or the focused suite flakes without an identified product or harness cause."
    },
    {
      "id": "terminal-session.kill-all-surface-cleanup",
      "title": "Kill all sessions removes only the confirmed terminal surfaces and current bindings",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-main-contract",
      "surfaces": [
        "terminal lifecycle",
        "terminal tab cleanup",
        "PTY shutdown",
        "Manage Sessions",
        "Resource Manager"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS deterministic evidence covers the renderer snapshot/coordinator, exact local and SSH-shaped PTY request settlement, active-last and pinned terminal-tab routing, component-unmount continuation, and the existing current/legacy daemon management contract. Windows Electron process absence, live SSH/WSL behavior, and remote-runtime/mobile host completion remain explicit gaps. The audit removed the isolated terminal-tab close routing suite. Forced-pin close-call shape, editor-before-browser fallback, browser fallback, empty-worktree deactivation and no replacement-terminal routing lose their supplied-store spy assertions. Remaining lifecycle/coordinator suites are not claimed to reproduce those isolated routing alarms.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/8001"],
      "invariant": "Every terminal surface confirmed in the invoking renderer is force-closed exactly once after daemon management settles, later-created surfaces and non-terminal tabs survive, and exact shutdown requests are limited to deduplicated current non-runtime PTY bindings of the confirmed surfaces.",
      "oracle": "Snapshot terminal entity IDs before the first await; mutate ownership, active selection, bindings, and tab presence while daemon management is pending and between bounded close batches; then assert only the immutable targets disappear from both terminal stores, active targets close last with valid editor/browser/deactivated post-state, every captured exact PTY promise settles before callbacks, and no provider inventory sweep or late-tab kill occurs.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "focused renderer/main unit and performance-count tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The focused 27-test slice passed locally once; it needs CI and soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The initial 100-tab implementation exposed an oversized close batch; two-close event-loop batching fixed the structural issue. The gate now uses deterministic batch instrumentation because full-suite CPU saturation made wall-clock assertions flaky; saved CI artifacts and intentional-break evidence are still needed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The coordinator performs one management sweep, builds an initial live-owner index, and revalidates at most once after each two-close yield when the Zustand state changed (at most 49 replans for the 100-tab fixture). It closes each present unique target once and sends at most one exact kill per unique current non-runtime PTY not already settled by daemon management. The fixture asserts 100 close attempts, 100 local kill calls, at least 100 store writes, and 49 yields; planner-level tests prove each individual plan build scans terminal and unified ownership stores once. Production diagnostics report measured close-batch duration, while the deterministic gate makes no machine-load-sensitive latency claim."
      },
      "promotionCriteria": [
        "Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach Windows Electron evidence for both entry points, empty and established terminals, later-tab survival, xterm removal, and initial PTY absence after settlement.",
        "Exercise the SSH fixture and WSL when available, or keep their live process-absence gaps explicit.",
        "Propagate and align runtime-host tab-close completion before claiming verified remote-runtime shutdown."
      ],
      "knownGaps": [
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Windows Electron screenshots and live process/xterm absence evidence were not produced by this local macOS run.",
        "Live SSH and WSL process absence, Linux local/daemon behavior, and mobile/relay shutdown remain unproved.",
        "Runtime-host terminal close is best-effort because closeTerminalTab still discards the existing async host result and its close-intent lifetime is shorter than the possible RPC flow.",
        "Daemon adapter listing failures remain suppressed by the existing management API, so reported daemon counts are not authoritative verification of every process.",
        "The audit removed the isolated terminal-tab close routing suite. Forced-pin close-call shape, editor-before-browser fallback, browser fallback, empty-worktree deactivation and no replacement-terminal routing lose their supplied-store spy assertions. Remaining lifecycle/coordinator suites are not claimed to reproduce those isolated routing alarms."
      ],
      "demotionRule": "Keep experimental or demote to protection none if the gate flakes, permits a late-created tab or unrelated PTY to close, duplicates provider shutdown, or performs more than one ownership replan per bounded yield."
    },
    {
      "id": "terminal-session.explicit-close-retirement",
      "title": "Explicit terminal close retires parked PTYs and agent authority exactly once",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "main-preload-renderer-electron-contract",
      "surfaces": [
        "terminal tab close",
        "split pane close and detach",
        "hidden terminal parking",
        "agent resume authority"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local", "daemon", "ssh", "runtime"],
      "coverageNotes": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4327",
        "https://github.com/stablyai/orca/pull/14590",
        "https://github.com/stablyai/orca/pull/8628",
        "https://github.com/stablyai/orca/pull/8706",
        "https://github.com/stablyai/orca/issues/14524"
      ],
      "invariant": "Close permanently removes the owned provider session, agent descendants, persisted tab/layout authority, and resume authority even when no TerminalPane is mounted; final-pane CLI close commits durable tab retirement before PTY stop can publish graph loss, does not acknowledge before that retirement, and treats the later exit retirement as idempotent. Workspace-wide CLI close applies that same durable contract to every terminal in exactly one worktree, including pinned and persisted-only surfaces, without touching sibling-worktree PTYs or resume records. A persisted explicit-empty state prevents initial-tab fallback from repopulating the workspace after reload or restart. A handle remains valid while the same provider-attested PTY incarnation survives renderer reload or re-key, and becomes stale without adopting a replacement incarnation. A terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
      "oracle": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
        "pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/pty/process-retirement/pty-descendant-termination.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
        "pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1",
        "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
        "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
        "pnpm run test:e2e -- tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts --workers=1",
        "pnpm run test:e2e -- tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts",
        "src/main/ipc/agent-hooks.test.ts",
        "src/main/ipc/agent-pane-authority-ownership.test.ts",
        "src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts",
        "src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts",
        "src/main/pty/process-retirement/pty-descendant-termination.test.ts",
        "src/main/daemon/sessions/testing/session.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host.test.ts",
        "src/main/providers/local-pty/local-pty-provider-shutdown.test.ts",
        "src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
        "src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts",
        "src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts",
        "src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts",
        "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
        "tests/e2e/terminal-tab-close-restart-persistence.spec.ts",
        "tests/e2e/terminal-parked-close-retirement.spec.ts",
        "tests/e2e/agent-descendant-process-kill.spec.ts",
        "tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts",
        "tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts",
          "assertions": [
            "final-pane terminal.close remains pending until one renderer durability acknowledgement retires the persisted tab and layout",
            "final-pane externally owned teardown commits session retirement before PTY stop, tolerates duplicate exit retirement, and preserves an unrelated live canary",
            "post-ack workspace-session loss falls back to renderer cleanup and verified PTY teardown while every pre-ack retirement error remains non-destructive",
            "renderer reload with the same provider-attested PTY incarnation preserves the exact handle",
            "same-id replacement incarnation publishes a new handle and makes the old handle deterministically stale",
            "hard graph loss and preallocated-handle supersession make the retained renderer handle deterministically stale"
          ]
        },
        {
          "file": "tests/e2e/terminal-tab-close-restart-persistence.spec.ts",
          "assertions": [
            "a durability-acknowledged whole-tab close leaves zero terminal tabs and provider sessions after restart"
          ]
        },
        {
          "file": "tests/e2e/terminal-parked-close-retirement.spec.ts",
          "assertions": [
            "a long-lived exact PTY remains alive after its terminal view is parked",
            "closing the parked tab removes the exact PTY from the provider inventory and the visible tab model"
          ]
        },
        {
          "file": "tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts",
          "assertions": [
            "an attached-window desktop host publishes the CLI-created terminal under the renderer publication epoch it inherits, proving the vulnerable classification path was taken rather than a headless or serve/SSH-shaped one",
            "with the target as the first host-created terminal, a renderer graph sync leaves the `terminal.create` tab in the host session inventory still naming its original daemon PTY",
            "the original fixture process answers a write through that handle with its own pid and a single READY line, so a respawned replacement cannot pass as a survivor",
            "the paired client applied that same sync and kept the tab with no replacement or resume tab appended",
            "an unrelated workspace keeps its own CLI terminal and PTY, and the client raises no direct local connection attempt or uncaught renderer error"
          ]
        },
        {
          "file": "tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts",
          "assertions": [
            "a windowless serve host publishes host-created terminals under a headless epoch, never a renderer one, which is why it cannot reach the window-conditioned prune the desktop arm reproduces",
            "a later CLI dispatch leaves the earlier host-created terminal in the serve-host inventory still bound to its original PTY",
            "both original fixture processes answer writes through their own handles after the later dispatch",
            "the paired client mirrors exactly those two tabs with no replacement or resume tab appended, no direct local connection attempt, and no uncaught renderer error"
          ]
        },
        {
          "file": "src/main/ipc/agent-pane-authority-ownership.test.ts",
          "assertions": [
            "pane authority transfer accepts only the canonical legacy/scoped runtime handle bound to the authoritative pane"
          ]
        },
        {
          "file": "src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
          "assertions": [
            "owned provider shutdowns start together so process-table snapshots can coalesce within a batch",
            "inventories above 32 sessions never exceed 32 concurrent provider shutdowns"
          ]
        },
        {
          "file": "tests/e2e/agent-descendant-process-kill.spec.ts",
          "assertions": [
            "a detached-pgid descendant is alive before agent PTY kill and absent afterward"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-14",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
          "result": "passed",
          "durationSeconds": 8.38,
          "summary": "Six owner-level checks proved durable final-pane retirement, same-incarnation handle and waiter continuity, and deterministic stale fencing at replacement or hard lifecycle boundaries.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts"
        },
        {
          "date": "2026-08-15",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
          "result": "passed",
          "durationSeconds": 4.49,
          "summary": "Fifteen checks passed after merging latest main, including post-ack session-loss cleanup and the inverse non-destructive pre-ack error proof.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "fresh E2E build plus isolated local Electron parked-close and descendant-kill tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The Electron gate passed three times locally, including the final review-fix head through the registered fresh-build command; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): STA-4327 used two byte-identical oracles. Runtime oracle cd248b67cc10ef64f2def315b86c3b0236b102639d03c65a0c5d9519e538d3af failed the same three durability/continuity checks on reported v1.4.180 (0b62333cf1), latest main (9bb8836bb6), and disabled fix; runtime candidate 3cf8a37447 passed 5/5, and final code candidate 121e112d77 separately passed its expanded 6/6 oracle. Renderer oracle 3b0949eef8b792cf5b09cfa55341f4216c08714f158e4b132e988e8114636cea failed both explicit-empty hydration/fallback checks on v1.4.180, latest main, and disabled fix, while renderer candidate 121e112d77 passed 2/2. The 1.4.187 recurrence oracle deterministically failed with historical tab_not_found when PTY stop was moved ahead of durable retirement, then passed with retirement committed before externally owned teardown while the canary remained live."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The close path is user-triggered and bounded by canonical live-owner indexing. Production ps has a 1s kill timeout; 20 same-turn requests execute one fresh process-table read, while requests arriving after a scan starts immediately share one successor so their deadline is not consumed waiting and no unusable ps starts after timeout. Completed tables are never reused. Bulk worktree shutdown runs in 32-wide batches so each batch can coalesce its initial scan without unbounded provider fanout. Descendant traversal uses a visited set and index cursor; a Node 24 local 100,000-wide synthetic tree fell from 861ms to 16.7ms, and escalation indexes only the requested descendant PIDs instead of duplicating the full process table. Escalation uses the same bounded coordinator, and kill-all store scale remains covered by terminal-session.kill-all-surface-cleanup."
      },
      "promotionCriteria": [
        "Accumulate 100 clean runs or 14 days on required CI platforms.",
        "Add live Windows/ConPTY, Linux, WSL, SSH, and ordinary runtime process-absence evidence.",
        "Add restart/no-resurrection and repeated park-close soak coverage."
      ],
      "knownGaps": [
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 40.3,\n          \"summary\": \"A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 37.7,\n          \"summary\": \"A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 78,\n          \"summary\": \"The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 18.8,\n          \"summary\": \"A fresh isolated Electron profile closed a split terminal tab through the runtime CLI and kept both renderer and runtime terminal inventories empty after restart.\"\n        }",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The live Electron proof currently covers macOS local PTYs only.",
        "Disconnected SSH relay death still requires reconnect-aware provider ownership.",
        "Daemon owner leases and durable retry inventory remain follow-up hardening.",
        "Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
        "A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
        "A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot.",
        "recordTerminalSurfaceRetirement advances the INCOMING session's terminal topology revision, so a tombstoned close whose write carries a revision at or below the store's own is rebased away instead of persisting. Pre-existing for every repo already past revision 0 and unchanged by the host-admitted membership fix, which only makes more repos reach that state sooner; the authoritative close path (stageTerminalSurfaceRetirements) computes from the store's session and is unaffected. Known, unaddressed, and deliberately out of scope here: the safe correction is per-tab rather than per-worktree rebase arbitration, because raising the incoming revision wholesale would re-open the host-tab loss whenever a close coincides with a host create.",
        "The SSH relay reattach binding (src/main/ssh/ssh-relay-session.ts persistPtyBinding) is NOT flagged host-admitted, so a lease rebind that has to mint a missing tab raises no fence. It rebinds an existing lease rather than admitting a new surface, so it is believed not to need one, but that was not established either way. Known, unaddressed, and deliberately out of scope here.",
        "The host-created retention journey is macOS-local; the reported incident was on a physical Windows host, which we did not run against.",
        "The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged.",
        "The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical.",
        "The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its retained 100-tab case measures one scan of each ownership store only. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical.",
        "The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed.",
        "The duplicate paired CLI graph-sync journey with an earlier unrelated host-created terminal was retired. The first-host-created-terminal journey retains the same original-PTY reply, host/client inventory and unrelated live canary oracles; target-after-unrelated ordering is no longer separately asserted. A single sync does not prove persisted restart durability. Historical evidence runs/results/counts remain unchanged.",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"workspace-wide close force-retires pinned and unpinned tabs, clears resume/incarnation state, awaits both target PTYs, preserves the sibling worktree, and reports an unconfirmed stop as unverifiable\"]}]",
        "Audit1863 removes the standalone local pane-to-PTY equality example. Its direct local-PTY authority alarm is intentionally lost; retained canonical runtime-handle tests do not replace it or prove physical pane/session retirement. Existing E2E and continuity receipts remain scoped to their original commands and counts.",
        "Audit1904 reduces persistence-pty-binding-reconciliation from six to four definitions, intentionally losing legacy remap-load and first-binding projection alarms. Current selector/testFile remains valid, with no selected-source assertionRef or active matching receipt. The six unchanged close/continuity receipts keep their exact original scope; no new broad gate or replacement evidence is claimed. Lost direct alarms: 'remaps legacy SSH lease leaf ids by PTY when the layout is already normalized'; 'promotes an empty tab layout to a durable UUID root when persisting the first PTY binding'.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit3323 (reconciled source audit3320) intentionally retires seven low-value renderer authority/retirement examples: retires one pane, clears resume authority, and rejects late status without harming siblings — Late status reviving a retired pane, sibling damage, or resume authority left behind.; can retire live pane authority while retaining its sleeping session — Retiring live authority accidentally dropping a retained sleeping session.; keeps a physical pane routed through chained detaches until its current owner closes — Chained detach alias routing broken after original owner closes, or alias survives final close.; forgets routing aliases for purged tabs — Purged-tab routing aliases lingering.; retires split, relay, deferred, and pending sessions for a parked tab — Split, relay, deferred or pending session omitted from teardown, sleeping-record sibling damaged, parked disposer skipped.; retires parked ownership before teardown and sweeps published state before unified close — Parked cleanup/provider teardown/state removal/sweep/unified-close ordering changes.; starts mixed provider teardown and classifies both rejection kinds after synchronous retirement — Mixed teardown failures blocking retirement, or local/runtime warning counts misclassified.. Remove the exact-pane-retirement and chained-detach assertion references because their source cases are gone. Other retained cases do not replace these alarms. Preserve all dated evidenceRuns and prior history with their original source scope; no fresh execution or historical import-closure equivalence is claimed.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 complete prior commands before completed-worker-retirement-resume retirement: [\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/pty/process-retirement/pty-descendant-termination.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts --workers=1\",\"pnpm run test:e2e -- tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts --workers=1\"]",
        "Audit3437 complete prior testFiles before completed-worker-retirement-resume retirement: [\"src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"src/main/agent-hooks/server/testing/authority/server-pane-authority.test.ts\",\"src/main/ipc/agent-hooks.test.ts\",\"src/main/ipc/agent-pane-authority-ownership.test.ts\",\"src/main/persistence/terminal-topology/persistence-pane-identity-migration.test.ts\",\"src/main/persistence/terminal-topology/persistence-pty-binding-reconciliation.test.ts\",\"src/main/pty/process-retirement/pty-descendant-termination.test.ts\",\"src/main/daemon/sessions/testing/session.test.ts\",\"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\"src/main/providers/local-pty/local-pty-provider-shutdown.test.ts\",\"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"src/renderer/src/store/slices/agent-status/agent-pane-authority.test.ts\",\"src/renderer/src/store/terminals/terminal-pane-detach-agent-identity.test.ts\",\"src/renderer/src/store/terminals/terminal-tab-retirement-store.test.ts\",\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts\",\"tests/e2e/terminal-tab-close-restart-persistence.spec.ts\",\"tests/e2e/terminal-parked-close-retirement.spec.ts\",\"tests/e2e/agent-descendant-process-kill.spec.ts\",\"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts\",\"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts\"]",
        "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-close-continuity.test.ts\",\"assertions\":[\"final-pane terminal.close remains pending until one renderer durability acknowledgement retires the persisted tab and layout\",\"final-pane externally owned teardown commits session retirement before PTY stop, tolerates duplicate exit retirement, and preserves an unrelated live canary\",\"post-ack workspace-session loss falls back to renderer cleanup and verified PTY teardown while every pre-ack retirement error remains non-destructive\",\"renderer reload with the same provider-attested PTY incarnation preserves the exact handle\",\"same-id replacement incarnation publishes a new handle and makes the old handle deterministically stale\",\"hard graph loss and preallocated-handle supersession make the retained renderer handle deterministically stale\"]},{\"file\":\"tests/e2e/terminal-tab-close-restart-persistence.spec.ts\",\"assertions\":[\"a durability-acknowledged whole-tab close leaves zero terminal tabs and provider sessions after restart\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"explicit close revokes the exact live recovery record both before and after PTY exit removes the tab, while PTY exit alone preserves interrupted-session recovery\"]},{\"file\":\"tests/e2e/terminal-parked-close-retirement.spec.ts\",\"assertions\":[\"a long-lived exact PTY remains alive after its terminal view is parked\",\"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model\"]},{\"file\":\"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts\",\"assertions\":[\"an attached-window desktop host publishes the CLI-created terminal under the renderer publication epoch it inherits, proving the vulnerable classification path was taken rather than a headless or serve/SSH-shaped one\",\"with the target as the first host-created terminal, a renderer graph sync leaves the `terminal.create` tab in the host session inventory still naming its original daemon PTY\",\"the original fixture process answers a write through that handle with its own pid and a single READY line, so a respawned replacement cannot pass as a survivor\",\"the paired client applied that same sync and kept the tab with no replacement or resume tab appended\",\"an unrelated workspace keeps its own CLI terminal and PTY, and the client raises no direct local connection attempt or uncaught renderer error\"]},{\"file\":\"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts\",\"assertions\":[\"a windowless serve host publishes host-created terminals under a headless epoch, never a renderer one, which is why it cannot reach the window-conditioned prune the desktop arm reproduces\",\"a later CLI dispatch leaves the earlier host-created terminal in the serve-host inventory still bound to its original PTY\",\"both original fixture processes answer writes through their own handles after the later dispatch\",\"the paired client mirrors exactly those two tabs with no replacement or resume tab appended, no direct local connection attempt, and no uncaught renderer error\"]},{\"file\":\"src/main/ipc/agent-pane-authority-ownership.test.ts\",\"assertions\":[\"pane authority transfer accepts only the canonical legacy/scoped runtime handle bound to the authoritative pane\"]},{\"file\":\"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\"assertions\":[\"owned provider shutdowns start together so process-table snapshots can coalesce within a batch\",\"inventories above 32 sessions never exceed 32 concurrent provider shutdowns\"]},{\"file\":\"tests/e2e/agent-descendant-process-kill.spec.ts\",\"assertions\":[\"a detached-pgid descendant is alive before agent PTY kill and absent afterward\"]}]"
      ],
      "demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, late hooks can recreate closed authority, or a renderer graph sync retires a host-created tab that no explicit close retired."
    },
    {
      "id": "terminal-session.daemon-generation-reconnect-safety",
      "title": "Negotiated close intent protects live daemon-generation terminals",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "renderer-runtime-rpc-daemon-contract",
      "surfaces": [
        "runtime session reconnect",
        "legacy daemon adoption",
        "mixed-version paired viewer close",
        "terminal lifecycle close",
        "app relaunch and profile reconnect"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon", "runtime", "ssh", "wsl"],
      "coveredPlatforms": ["linux", "macos", "windows"],
      "coveredProviders": ["daemon", "runtime"],
      "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2153: Reduced sources intentionally lose the forwarding smoke and retire an unrelated current selector; historical runs do not validate changed source bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/9749",
        "https://github.com/stablyai/orca/issues/9949",
        "https://github.com/stablyai/orca/issues/8871",
        "https://github.com/stablyai/orca/issues/9138",
        "https://github.com/stablyai/orca/issues/9229"
      ],
      "invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.",
      "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
        "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/construction/orca-runtime.test.ts",

        "src/main/runtime/rpc/e2ee-channel.test.ts",
        "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
        "src/main/runtime/rpc/mobile-socket-wiring.test.ts",
        "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
        "src/shared/remote-runtime/remote-runtime-client.test.ts",
        "src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts",
        "src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
        "src/cli/runtime/websocket-transport.test.ts",
        "src/renderer/src/web/web-runtime-client.test.ts",
        "src/renderer/src/components/terminal/terminal-tab-actions.test.ts",
        "src/renderer/src/components/terminal/terminal-close-incarnation.test.ts",
        "src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
        "tests/e2e/daemon-generation-reconnect-safety.spec.ts",
        "tests/e2e/daemon-generation-legacy-close-safety.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/daemon-generation-legacy-close-safety.spec.ts",
          "assertions": [
            "one identified capable viewer and one legacy viewer issue byte-identical sequential reasonless closes while a third viewer lists every target before, between, and after but issues zero closes",
            "capable v25/v26 PTY root/descendant incarnations in separate worktrees survive, answer post-close input, and produce zero shutdown calls and zero daemon session-killed events",
            "legacy v25/v26 PTY root/descendant incarnations die through ordered immediate shutdown calls with one daemon session-killed event each, matching current-main behavior",
            "an unaddressed fifth-worktree PTY root and descendant survive with zero kill events, excluding global fanout",
            "the JSON reconstruction records request order, negotiated capabilities, viewer connection, worktree/tab/PTY ids, daemon PID/protocol, call site, and exact before/after process liveness"
          ]
        },
        {
          "file": "tests/e2e/daemon-generation-reconnect-safety.spec.ts",
          "assertions": [
            "the production scanner discovers v21/v22/v23/v24/v25 from v26 and every generation accepts repeated client hellos while every exact daemon, PTY-root, and descendant incarnation remains alive",
            "desktop and two remote profiles repeat lifecycle closes before and after client relaunch with zero session-killed events",
            "shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree"
          ]
        },
        {
          "file": "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
          "assertions": ["mobile E2EE v2 continues to reject additive runtime capability metadata"]
        },
        {
          "file": "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
          "assertions": [
            "the authenticated capability parser accepts only bounded string arrays and rejects malformed or oversized input"
          ]
        },
        {
          "file": "src/shared/remote-runtime/remote-runtime-client.test.ts",
          "assertions": [
            "one-shot and subscription runtime clients remain compatible while sending encrypted client authentication"
          ]
        },
        {
          "file": "src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts",
          "assertions": [
            "the cached paired-desktop request connection advertises close-intent support in encrypted authentication while reusing one socket"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-27",
          "runner": "ci",
          "platform": "linux",
          "command": "pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 6.6,
          "summary": "Current-head capability-gated oracle passed in E2E run https://github.com/stablyai/orca/actions/runs/30250731941/job/89928386794: capable v25/v26 roots and descendants survived with snapshot republish and post-close I/O, byte-identical legacy closes retained current-main shutdown behavior, and the unrelated fifth-worktree control survived.",
          "currentCommand": "pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-07-21",
          "runner": "local",
          "platform": "windows",
          "command": "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 137.1,
          "summary": "The full command, including a fresh Electron E2E build, passed. Production desktop discovery found v21/v22/v23/v24 from v25; all five daemons and all ten exact PTY-root/descendant canaries survived six repeated lifecycle attempts per stale mirror with zero session-killed events. Bounded shutdown-dispose-failed dropped pipe authority while its refusing daemon/root/descendant remained alive until exact fixture cleanup; no fixture directory remained.",
          "currentCommand": "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "isolated native-Windows generation reconnect plus two-generation mixed-version close adjudication and fresh E2E build"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Local deterministic Windows evidence includes the final two-scenario pass and a separate 25-burst stress pass; CI and 14-day soak history are absent."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Current main and PR #10013 route both reasonless viewer sequences to immediate shutdown, while the prior global-refusal candidate incorrectly preserves the legacy sequence. The capability-gated candidate passed the combined GitHub oracle: capable v25/v26 PTYs survive and answer input, legacy PTYs retain current-main shutdown behavior, and the unrelated control survives. Existing Windows red/green evidence separately covers evidence-bearing lifecycle closes."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Production adds one bounded client-capability parse during the authenticated connection handshake and one constant-time membership branch per close. It adds no polling, subprocess, provider listing, retry, timer, or process-per-session work. Refusal reuses the existing single-worktree snapshot republish. Test-only inventory and cleanup are bounded."
      },
      "promotionCriteria": [
        "Collect 100 clean native-Windows runs over 14 days with zero unexplained flakes.",
        "Add packaged Electron update/relaunch evidence with the same exact PTY survival oracle.",
        "Add live Linux SSH-relay and Windows WSL reconnect artifacts without weakening keep-on-unknown."
      ],
      "knownGaps": [
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "The strongest proof is Electron-as-Node over real daemon PTYs, not a packaged headed Orca host paired to a separate old client; that is the primary live E2E still required.",
        "Headless orca serve parity, live Linux, Linux SSH relay, and Windows WSL reconnect are not exercised; Docker SSH would cover only the SSH provider and cannot substitute for paired Orca-server evidence.",
        "A topology containing any pre-contract paired desktop viewer remains vulnerable to that viewer's stale reasonless close storm; preserving its intentional-close behavior makes this unavoidable until the viewer upgrades.",
        "Cross-profile daemon inventory and generation handoff/retirement remain the separate #9138/#9229 design.",
        "A dead split leaf stays with its authoritative owner rather than being remotely pruned.",
        "The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage.",
        "The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage.",
        "The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage.",
        "Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"live, unknown, stale, missing-intent, non-owner, and inventory-proven but not yet pane-bound lifecycle closes invoke neither PTY kill nor renderer close\",\"dead whole-headless retirement removes stale state without signalling a retained PTY id\"]}]",
        "Audit1939 (sources1934/1935): Retain actual parked exit/disposal/cancel/leaf progression using injected exit and close adapters. The retained last-watcher case checks exact lifecyclePtyId, but no retained callback establishes the whole existing replacement-or-sibling-incarnation alias. Retire that broad assertion object rather than transfer partial support. Capability admission, static fields and duplicate routing examples are intentionally lost; unchanged daemon E2E receipts remain scoped to their own commands. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'never starts a watcher for a PTY that exited into the park handoff gap'; 'collapses the exited leaf out of the stored layout when deferring'; 'retires launch/title hints when the launch-owning parked leaf exits'; 'keeps launch ownership when only a parked shell sibling exits'; 'rejects ordinary parking for a preserved daemon with a lossy snapshot'; 'rejects a capture containing a PTY without snapshot backing'; 'accepts layout-derived candidates when the capture is stale'; 'rejects layout-derived candidates missing a leaf PTY binding'.",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n          \"assertions\": [\n            \"parked lifecycle closes carry the exact exiting PTY and cannot borrow a replacement or sibling incarnation\"\n          ]\n        }",
        "Audit1959 (sources 1957:11, 1957:35, 1957:36): The fixture-supplied repository roundtrip, isolated capability metadata readback, parser/default-timer/size-threshold/internal failure-counter examples and standalone handshake-only replay example are removed. Source11 retains real encrypted multi-client event ordering, reconnect snapshot and multiplex delivery under synthetic runtime state, and does not establish the broad handshake-to-reasonless-close refusal alias; retire that whole assertion object. Source36 capability metadata readback alias is retired. Source35 retains the actual v2 runtime-only metadata/downgrade refusal callback and captured mutating-trace fresh-nonce rejection; its mapped mobile-v2 refusal alias remains within modeled credential lookup scope. Both independent daemon E2E dated receipts remain byte-exact with their original commands and results. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet.",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/remote-runtime-request-connection.integration.test.ts\",\n          \"assertions\": [\n            \"the real encrypted WebSocket handshake binds close-intent capability through authenticated socket state and RPC context to reasonless-close refusal\"\n          ]\n        }",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/e2ee-channel.test.ts\",\n          \"assertions\": [\n            \"runtime capabilities are accepted only from encrypted authentication metadata, not the unauthenticated hello\"\n          ]\n        }",
        "Audit1983: Delete the reasonless-close scalar suite and optional-capability socket forwarding alias. Delete the mocked close-attribution topology field-inventory suite and its aliases/selectors; preserve independent dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/runtime-close-attribution-topology.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/session-tabs/session-tabs.test.ts\"",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs.test.ts\",\n          \"assertions\": [\n            \"in-process and capable-runtime reasonless closes refuse while legacy runtime/mobile and explicit current user closes retain current-main destructive semantics\"\n          ]\n        }",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/mobile-socket-wiring.test.ts\",\n          \"assertions\": [\n            \"the optional client capability is captured from legacy encrypted authentication and bound to the authenticated runtime-scoped socket identity\"\n          ]\n        }",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/runtime-close-attribution-topology.test.ts\"",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/runtime-close-attribution-topology.test.ts\",\n          \"assertions\": [\n            \"remote, legacy, reconnect, stale, concurrent, cross-worktree, and unowned close spans retain authoritative runtime, target, requester, decision, and outcome identities without serializing the bearer credential\",\n            \"close attribution adds no terminal inventory scan or provider fanout\"\n          ]\n        }",
        "Audit2020: The CLI WebSocket source retains old-protocol refusal only; its paired-open, capability, timeout and admission projection examples are removed. No daemon-generation coverage is transferred to that callback. Both independent daemon E2E receipts remain unchanged at their original commands; the reduced unit selector has no fresh result.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit2153: Intentionally retire the ordinary fake-create event-forwarding registration from src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts. The two retained callbacks prove encrypted fanout/reconnect and physical connection multiplexing under a fake business runtime; neither establishes close-intent authorization, actual terminal sleep, or equivalent replacement for the removed forwarding smoke. Remove this unrelated current close-safety selector. Existing assertionRefs and dated evidenceRuns remain byte-identical and scoped to their own source/commands. No fresh execution or platform/provider coverage is claimed.",
        "Audit2153 historical original commands item, preserved verbatim; retired selector is not active execution evidence: \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\"",
        "Audit2153 historical original testFiles item, preserved verbatim; retired selector is not active execution evidence: \"src/main/runtime/rpc/server/remote-runtime-request-connection.integration.test.ts\"",
        "Terminal/runtime defining-owner cleanup retires complete parking timer, lifecycle, mocked close/disposal and render/flip/mount work-count cases under repository test policy. The retained watcher source has only two literal-oracle coverage decisions; the retained cold-parking hook source has only the layout-PTY exemption invalidation case. Lost alarms include cooldown/measure/pin wakeups, split exit/close attribution and cancellation, watcher disposal/restart, flood timer rearm, worktree verdict damping, and destroyed-transport cold restore. No equivalent replacement coverage or execution pass for the reduced cases is claimed; prior dated receipts retain their original scope.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
      ],
      "demotionRule": "Keep experimental or quarantine if reconnect emits session-killed for a live canary, an exact root/descendant dies, an old server receives fallback destructive close, cleanup leaks a fixture process/pipe, or the gate flakes without a proven harness defect."
    },
    {
      "id": "terminal-session.startup-cwd-missing-dir-recovery",
      "title": "Terminal working-directory recovery stays scoped and provider-safe",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "shared-main-renderer-and-posix-shell-contract",
      "surfaces": [
        "terminal lifecycle",
        "tab creation",
        "PTY spawn",
        "startup cwd persistence",
        "long-lived Bash and Zsh OMP launches"
      ],
      "platforms": ["macos", "linux", "windows", "mobile"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3077 retires the sole active passed IPC receipt; no current execution evidence remains for this gate. Historical account (not current coverage): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1760 removes the standalone startup-cwd policy suite without equivalent replacement. One fresh Linux run passed21 retained IPC transport unit cases; cwd-specific coverage returns mocked fallback metadata only. Original receipts and scope are archived in knownGaps; current platform scope reflects this unit run, not a native provider. Historical coverage account (not current evidence): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1396 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Local macOS evidence covers the shared missing-dir fallback policy, main pty:spawn recovery and metadata, no-flag and reattach strictness, renderer IPC flag routing, SSH-tagged and remote-runtime omission, and the visibility-gated terminal notice. Real Bash and Zsh node-pty tests replace the active cwd inode and exercise the shared POSIX OMP wrapper; audit829 removes generated-file snapshots and their current byte-parity claim. No equivalent replacement for generated-script byte checks is claimed. Daemon shares the same pre-provider main cwd decision but lacks a live daemon-provider run; WSL UNC paths are exempt from the spawn probe and lack a live run; native PowerShell is unaffected; Linux/Windows and mobile/API strictness remain gaps. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/7239",
        "https://github.com/stablyai/orca/pull/7750",
        "https://github.com/stablyai/orca/pull/7678",
        "https://github.com/stablyai/orca/issues/16457",
        "https://github.com/stablyai/orca/pull/17128"
      ],
      "invariant": "A fresh local renderer terminal spawn may recover from a saved startup cwd whose directory no longer exists only by spawning at the selected workspace root and printing a generic in-terminal notice; existing directories — including ones outside the worktree (#7685) — spawn as requested, and reattach, SSH, remote-runtime, runtime/API, and mobile callers keep exact cwd semantics. A long-lived POSIX shell whose cwd inode was deleted and replaced may run a wrapped OMP command from the live path named by its logical PWD only in a subshell; the parent shell cwd, OMP argv, status extension, and exit status remain unchanged, while a genuinely unavailable path fails visibly without invoking OMP. A usable physical cwd remains authoritative when PWD is unset or names a removed logical symlink instead of being remapped to a workspace fallback.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The shared resolver falls back to the workspace root only when the injected existence probe reports the resolved cwd missing and the workspace root present, and never probes floating terminals or a cwd equal to the root. The renderer sends cwdFallback only for fresh local IPC spawns, main honors it only when connectionId and sessionId are absent, WSL UNC paths never engage the probe-based fallback, main returns fallback metadata only after an actual fallback, the IPC transport preserves that metadata, and the connection layer writes a generic notice that omits the missing path. In real interactive Bash and Zsh PTYs, unset PWD and remove a logical symlink while the physical cwd stays usable, requiring OMP to remain there; then delete and recreate the active project path, require extension-enabled and extension-skipping invocations to observe the replacement inode with byte-exact argv and nonzero status preserved, require the parent shell to remain on the stale inode, unset PWD and require recovery through ORCA_WORKTREE_PATH, clear every logical fallback and require an actionable failure without invoking OMP, and finally delete the replacement and require the same for the missing PWD path.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 40,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit3077: no current execution or soak result remains after retiring the reduced IPC source receipt. Historical account: Audit1760: one Linux IPC transport unit run passed21 cases; no current soak evidence. Original flake history archived in knownGaps."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1396 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The main IPC missing-cwd tests fail with the provider's 'Working directory ... does not exist.' error when the spawn fallback is removed and pass with it. Before the OMP recovery, the stale-inode reproduction makes the child process fail to resolve its cwd; the candidate rebinds to the recreated path in real Bash and Zsh PTYs. Full live Electron reproduction from a production persisted session is not captured."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. The spawn recovery adds at most two statSync probes on the fresh-local spawn path (the provider already stats the same paths during validation) and one bounded terminal write only when fallback actually occurs. Each wrapped OMP launch adds a constant number of shell filesystem predicates; only a detected stale/unusable cwd creates one short recovery subshell. No polling, retry, provider listing, hidden-pane work, startup awaits, extra OMP subprocesses, or render-loop work was added."
      },
      "promotionCriteria": [
        "Attach CI evidence for all declared test files.",
        "Add a live Electron regression that opens a local terminal whose persisted startupCwd was deleted and proves visible shell input/output at the workspace root.",
        "Add a live stale-inode OMP run on Linux or WSL and through an SSH/relay-generated wrapper.",
        "Add WSL/mobile/API spawn provider-contract coverage or explicitly narrow their risk scope."
      ],
      "knownGaps": [
        "Audit3077 archives the remaining startup-CWD selectors and aliases because protection none permits no active selectors. These unchanged sources are unvalidated candidates, not current execution evidence. The worktree-marker alias remains mapping debt; this metadata retirement adds no test-removal credit. Original candidate fields verbatim:\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/pty/shell-startup/omp-shell-wrapper.node-pty.test.ts src/main/pty/shell-startup/omp-shell-wrapper-alias-safety.test.ts\"\n      ]\ntestFiles: [\n        \"src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n        \"src/main/pty/shell-startup/omp-shell-wrapper.node-pty.test.ts\",\n        \"src/main/pty/shell-startup/omp-shell-wrapper-alias-safety.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n          \"assertions\": [\"fresh local IPC worktree spawns are marked with cwdFallback worktree\"]\n        }\n      ]",
        "Audit3077 retires the direct IPC startup-CWD metadata example, selector and alias. Other startup-CWD selectors and the existing worktree-marker mapping debt remain; no equivalent replacement is claimed.",
        "Audit3077 retires this complete dated receipt because its selected source was reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-07\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-connect-spawn.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 38.8,\n          \"summary\": \"21 retained IPC transport unit cases passed on Linux, including return of mocked startupCwdFallback metadata. No live PTY, real missing directory, recovery notice, native shell, SSH/WSL, phone, p95 or soak evidence. Executed via pinned Node24 Vitest entry, same root config and selected file; no actual provider coverage claimed.\"\n        }",
        "Audit3069 retires nominal spawn/resume/banner wiring, first-fit and lookup-budget variants, private pending-map checks, the split-CWD disposal suite and startup command/draft baseline variants. Distinct regression alarms are intentionally lost without equivalent replacement; retained ownership, cancellation and recovery cases remain. Existing selectors and dated evidence retain their original scope. The earlier generic-notice alias was already retired by audit3061; the remaining cwdFallback marker alias is unchanged mapping debt.",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope. The generic startup-cwd notice alias was already stale and is removed as pre-existing metadata debt; this batch receives no new removal credit for that alias. The separate cwdFallback marker alias remains outside this bounded reconciliation.",
        "Audit3037 retires the runtime-owner spawn-routing suite and its remote cwdFallback-absence assertion claim. Actual routing-composition alarms are intentionally lost; no replacement or renewed execution credit. Other historical claims and receipts retain their original scope.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No live Electron fixture seeds a persisted tab whose startupCwd directory was deleted.",
        "Daemon coverage is via the shared pre-provider main cwd decision, not a live daemon provider spawn.",
        "The stale-inode OMP oracle is local macOS Bash/Zsh plus shared generated-file parity; it does not execute through live SSH, relay, Linux, or WSL providers.",
        "WSL UNC paths bypass the spawn probe by design and have no live existence-recovery run; Linux, Windows, and mobile/API spawn strictness are not directly exercised.",
        "Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed.",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-08\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.5,\n          \"summary\": \"1 test file passed, 341 tests passed; covers local IPC marking, the generic terminal fallback notice, and remote-runtime omission.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts\"\n        }",
        "Audit1396 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"ssh\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1760 retired original receipt; complete record preserved: {\"date\": \"2026-07-08\", \"runner\": \"local\", \"platform\": \"macos\", \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts\", \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/shell/launch/terminal-startup-cwd.test.ts\", \"result\": \"passed\", \"durationSeconds\": 0.2, \"summary\": \"1 test file passed, 21 tests passed; covers the missing-dir fallback policy, #7685 outside-worktree preservation, and root-missing/floating exemptions.\"}",
        "Audit1760 retired original receipt; complete record preserved: {\"date\": \"2026-07-08\", \"runner\": \"local\", \"platform\": \"macos\", \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts\", \"result\": \"passed\", \"durationSeconds\": 0.34, \"summary\": \"1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff.\", \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-connect-spawn.test.ts\"}",
        "Audit1760 removes the standalone startup cwd policy examples without equivalent replacement. Current IPC unit source only checks returning mocked startupCwdFallback metadata; it does not retain the former local-fresh/SSH/reattach cwdFallback argument assertions. Original IPC assertion inventory: {\"file\": \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-connect-spawn.test.ts\", \"assertions\": [\"IPC transport sends cwdFallback only for local fresh spawns\", \"SSH-tagged and session reattach spawns omit cwdFallback\", \"IPC transport returns startup cwd fallback metadata to the connection layer\"]}",
        "Audit1760 historical platform/provider/flake account: {\"coveredPlatforms\": [\"macos\"], \"coveredProviders\": [], \"flakeHistory\": {\"status\": \"unknown\", \"evidence\": \"Changed selectors have no new soak result after Audit1396; any retained unchanged-source receipts apply only to their own commands. Historical account: New experimental gate added with local deterministic evidence only; needs CI soak before promotion.\"}}"
      ],
      "demotionRule": "Demote or quarantine if the gate flakes without a product bug, if an existing directory is ever remapped away from the requested cwd, if a reattach/remote/API caller can engage the spawn fallback, or if OMP recovery remaps a usable cwd with unset PWD, changes argv/status/parent cwd, or invokes OMP when the logical path remains unavailable."
    },
    {
      "id": "agent-status.pi-hook-liveness",
      "title": "Pi status hooks cannot stall a turn or complete a live runtime",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session",
      "layer": "main-provider-contract",
      "surfaces": [
        "Pi and OMP managed extensions",
        "agent status hooks",
        "runtime reload and session replacement",
        "loopback restart and stall recovery"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1598 removes canned hook/terminal/provider projections, fake process/launch inventories and duplicate search fixtures without equivalent replacement coverage. Retained checks cover local HTTP token isolation, disk snapshots and in-process restarts, shell spool files/curl failures, local mux byte boundaries and SQLite/FTS admission/index/publication. WSL children, process probes and provider events remain injected; in-process restart is not crash recovery, seeded recovery is not actual crash proof, and fake budgets do not establish latency. Deleted-source tests with a removeFile collector prove admission; retained integrated indexer coverage separately exercises actual SQL deletion. Historical scope before this audit: Local macOS execution of the generated Pi/OMP extension plus the shared hook normalizer. WSL fallback behavior is covered with mocked native-fetch failure and Windows curl handoff. Daemon PTYs use the same generated extension without a distinct delivery path. SSH/relay ingest uses the shared normalizer, but no live remote Pi process is exercised.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/7791",
        "https://github.com/stablyai/orca/pull/7802",
        "https://github.com/stablyai/orca/pull/7838"
      ],
      "invariant": "Orca status reporting must return synchronously from every Pi/OMP extension handler, retain at most one active request and one latest pending snapshot, and abandon stalled loopback delivery within one second. A Pi session_shutdown event cannot mark a turn done because Pi also emits it for reload, new, resume, and fork while the PTY remains alive; only agent_end proves turn completion, while real process exit is cleared by PTY teardown.",
      "oracle": "Execute the generated extension with a fetch that remains pending and assert the Pi handler returns before delivery; emit three statuses during the stall and assert exactly one request is active and only the latest pending status is sent next; advance fake time by one second and assert the active signal aborts and the latest status proceeds. Through the shared normalizer, assert session_shutdown yields no status while agent_end still yields done.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "generated-extension and shared-normalizer unit gate"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New deterministic gate with local fake-receiver and fake-timer evidence; needs CI soak before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Before the fix, the pending-fetch handler assertion remained false and session_shutdown normalized to done (2 focused failures, 233 passes). With the fix, both pass; the bounded count and deadline assertions additionally fail if latest-only coalescing or the timeout is removed. Needs saved CI evidence before blocking promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Every Pi event does O(1) work and returns without awaiting I/O. Delivery retains at most one active request plus one latest pending object, uses one unref'd timer per active request, and creates no polling, provider scans, subprocesses outside the existing WSL failure fallback, or renderer work. The deterministic burst test proves three stalled events retain two delivery slots rather than an event-count-sized queue."
      },
      "promotionCriteria": [
        "Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach saved red/green evidence for both the unresolved-handler and false-done regressions.",
        "Add a live Pi Electron test that stalls or restarts the hook listener during a running turn and proves terminal output continues."
      ],
      "knownGaps": [
        "Audit1598 removes canned hook/terminal/provider projections, fake process/launch inventories and duplicate search fixtures without equivalent replacement coverage. Retained checks cover local HTTP token isolation, disk snapshots and in-process restarts, shell spool files/curl failures, local mux byte boundaries and SQLite/FTS admission/index/publication. WSL children, process probes and provider events remain injected; in-process restart is not crash recovery, seeded recovery is not actual crash proof, and fake budgets do not establish latency. Deleted-source tests with a removeFile collector prove admission; retained integrated indexer coverage separately exercises actual SQL deletion.",
        "No live model-backed Pi turn or Electron Running-view assertion is automated; the gate executes the exact generated extension and shared normalizer below those surfaces.",
        "An already-running Pi process keeps its previously loaded extension until Pi reloads or restarts.",
        "During receiver unavailability, intermediate status details may be coalesced to the latest snapshot; this is intentional and bounded, but no UI test measures the temporary detail loss.",
        "SSH/remote and Windows are not exercised with live providers; relay ingest shares normalization and WSL fallback has mocked contract coverage."
      ],
      "demotionRule": "Demote or quarantine if the gate flakes without a product or harness bug, if a Pi handler can again await receiver I/O, or if coalescing allows an older status to overwrite a newer one."
    },
    {
      "id": "agent-status.manual-compact-identity",
      "title": "A finished Claude compact clears the pane, and an aborted one never strands it",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session",
      "layer": "shared-main-relay-contract",
      "surfaces": [
        "Claude status hooks",
        "manual compact lifecycle",
        "last-status persistence",
        "SSH relay ingest"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1610 deletes compact-status-registration.test.ts, a mock-only registration inventory. Its alarms are retired without equivalent replacement coverage; this gate has no remaining active assertion references. Historical scope before this audit: Audit1595 removes canned hook/installer/status/capture inventories and fixture-owned command scanners without equivalent replacement coverage. Retained checks cover local filesystem/symlink/shell/pipe and TCP deadlines, ACP timeline/journal failures, naming ownership/races and numeric release helper composition; provider/remote/process inventories remain injected. Native Windows cases are platform-gated; no actual remote deployment, Fastlane/Apple API or native provider identity proof. Historical scope before this audit: Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic listener, loopback HTTP, relay-restart, persisted-restore, and fake-SSH transport contracts run on macOS. Behavior tests deliver only events present in CLAUDE_EVENTS, so a mapping that is not registered cannot pass -- the failure mode that let the earlier compact correlation ship unreachable. Claude Code 2.1.227 PTY captures prove a successful manual compact emits PreCompact, a start-less summarizer SubagentStop, SessionStart(source=compact), then PostCompact, that an aborted compact emits PreCompact ALONE, that /compact emits no UserPromptSubmit, and that session_id is stable across the window. The shared Node paths are platform-independent; live Linux, Windows, WSL, and paired-runtime journeys remain gaps. The entire Claude-compatible vendor mapping suite is removed by Audit1297, including remaining vendor normalization samples. Audit1287 removes agent-hook-relay.test.ts, an isolated object/digest suite. Its unavailable-envelope normalization, identity-change and attribution alarms are intentionally lost; retained transport tests are not claimed equivalent. Audit1297: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-compatible-vendors.test.ts removed. Lose resumed Kimi session capture, harness prompt suppression and Muse permission/question/lifecycle/provider-session samples. No equivalent replacement coverage is claimed. Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-turn-state.test.ts: Synthetic Claude hook/state histories and a normalization/acceptance harness assert option/field mappings, internal caches and private lead-state mutation; no actual Claude lifecycle/cwd/interrupt producer. Intentionally lose resume/compact/clear/cwd/effort/child-wait/cancel restoration and cache-bound alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/agent-hooks/manual-compact-status-cleanup.test.ts removed. Late PostCompact cannot revive cleaned status across three cleanup APIs. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11352",
        "https://github.com/stablyai/orca/pull/11353"
      ],
      "invariant": "PreCompact is never registered and may never move a pane, because it fires before the compact is validated and an aborted compact emits it alone. Only a manual PostCompact may mark done, and it does so as a session boundary so completion-reactive consumers stay out of it; an automatic PostCompact claims nothing and writes no compact-scoped state, since its turn resumes and emits its own Stop. A completion either CLEARS a row or publishes nothing at all: it never creates a row, so a retired pane cannot be resurrected, and it never restates one it cannot clear, because a restated row loses restoredUnconfirmed and restarts the staleness clock. A manual /compact only completes at an idle prompt, so it retires a subagent that exists ONLY as a disk snapshot; live evidence -- a child observed in this runtime, an unclassifiable running background task, a registered session cron -- still holds the pane at working. A completion requires a valid provider prompt UUID, matches the pane owner by connection and provider session -- except on a restored row, which carries the previous connection and may carry no session at all -- and is applied at most once per compact. Ownership is enforced by the client that owns pane identity; a relay forwards and defers, so a cold relay cache cannot swallow the clearing event. A relay predating this contract forwards its own mapping, so ingest drops automatic envelopes, stamps the boundary on manual ones, carries the summarized turn label onto a promptless completion with or without a trigger, and classifies a trigger-stripped replay by payload state while still enforcing ownership. Kimi and other Claude-compatible vendors remain fail-closed.",
      "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Replay the measured Claude compact streams through a harness gated on the real CLAUDE_EVENTS, plus local HTTP, relay, SSH, and persisted-restore transports. Require the successful manual stream to end done with sessionBoundary set, and require PreCompact delivered directly past the registration gate to produce no normalized event. Drive the restart shape end to end over loopback HTTP from a hydrated row: a pane held only by a snapshot child must reach done with an empty roster, while a pane a runtime child still owns must emit NOTHING and keep its row object identical, so receivedAt and restoredUnconfirmed both survive. Deliver the restored-row cases with the hydrated row still cached at completion time and assert the summarizer published nothing, so the restored-row branch is the branch under test. Require rejection of an automatic completion, a completion with absent prompt UUID, a foreign provider session, a duplicate, and a completion for a pane with no cached row; require an automatic completion to leave the live turn working until its own Stop closes it. Require a relay with a COLD cache to forward the completion while the client still refuses to mint a row it never had. Require ingest to drop legacy automatic envelopes, stamp the boundary on legacy manual ones, carry the summarized turn label onto a promptless completion with and without a trigger, and leave a FINISHED pane finished when a trigger-stripped working replay arrives. Require pane, tab, and server cleanup to revoke compact completion authority. Assert managed hook settings, emitted event order, and the authoritative lastStatusByPaneKey snapshot.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1340; any retained unchanged-source receipts apply only to their own commands. Historical account: New deterministic gate with one local run; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1340 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The byte-identical oracle (SHA-256 24e80c15b467ffa9c47a81099f11bf26dea71293e47b5d950b2fad1497094764) failed 5 of 6 on origin/main@a20165a43d, passed 6 of 6 on the candidate, failed 3 of 6 when only the exact-transition guard was disabled, and passed 6 of 6 after restoration."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Each compact event performs one O(1) current-status lookup plus bounded UUID, source, connection, session, and event comparisons. Identity lives on the existing status row and is removed by its existing lifecycle; the change adds no owner map, global scan, polling, timer, subprocess, network request, or listener. The 4,097-key adversarial arm retains zero status, prompt, or ownership entries."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Run live manual compact journeys on Linux and Windows and through a real SSH target.",
        "Keep automatic compact completion disabled until a generation-unique provider identity is proven."
      ],
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1610 deletes compact-status-registration.test.ts, a mock-only registration inventory. Its alarms are retired without equivalent replacement coverage; this gate has no remaining active assertion references.",
        "Audit1595 removes canned hook/installer/status/capture inventories and fixture-owned command scanners without equivalent replacement coverage. Retained checks cover local filesystem/symlink/shell/pipe and TCP deadlines, ACP timeline/journal failures, naming ownership/races and numeric release helper composition; provider/remote/process inventories remain injected. Native Windows cases are platform-gated; no actual remote deployment, Fastlane/Apple API or native provider identity proof.",
        "No live Linux, Windows, WSL, paired-runtime, or real-SSH manual compact journey was run.",
        "Claude versions before prompt_id support intentionally cannot complete a manual compact row through PostCompact.",
        "Automatic Claude and Kimi completion remain intentionally fail-closed because their hooks do not prove an exact compact generation.",
        "The compact-registration source does not assert private consumed-compact map contents after automatic completion or cache teardown/move, or assert unchanged state after PreCompact is filtered by the test-owned registration gate; direct normalization and observable completion/ownership behavior remain covered.",
        "Audit1287 removes agent-hook-relay.test.ts, an isolated object/digest suite. Its unavailable-envelope normalization, identity-change and attribution alarms are intentionally lost; retained transport tests are not claimed equivalent.",
        "Audit1287 retires this complete historical receipt after test removals; its old counts/results do not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-08-18\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener-claude-turn-state.test.ts src/shared/agent-hook-listener-claude-compatible-vendors.test.ts src/shared/agent-hook-relay.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts --reporter=dot\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-turn-state.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-compatible-vendors.test.ts src/shared/agent-hook-listener/transport/agent-hook-relay.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.28,\n          \"summary\": \"Ten files and 116 tests passed across registration, listener, local HTTP, relay, SSH, persistence, and cleanup. Reverting only the four source files to the merge base first turned 12 of 21 registration-gated tests and 8 of 12 relay/ingest tests red, so the suite observes its own failure rather than passing over unreachable code. Every assertion was additionally mutation-tested: 18 of 18 targeted mutations -- including reaping runtime children as well as snapshot ones, restating a pane live evidence still holds, re-enforcing compact ownership on the relay, and dropping the consumed-compact map from any one teardown route -- are caught.\"\n        }",
        "Audit1297: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-compatible-vendors.test.ts removed. Lose resumed Kimi session capture, harness prompt suppression and Muse permission/question/lifecycle/provider-session samples. No equivalent replacement coverage is claimed.",
        "Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-turn-state.test.ts: Synthetic Claude hook/state histories and a normalization/acceptance harness assert option/field mappings, internal caches and private lead-state mutation; no actual Claude lifecycle/cwd/interrupt producer. Intentionally lose resume/compact/clear/cwd/effort/child-wait/cancel restoration and cache-bound alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-turn-state.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-turn-state.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.7,\n          \"summary\": \"Test Files  7 passed (7); Tests  87 passed (87). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1340: src/main/agent-hooks/manual-compact-status-cleanup.test.ts removed. Late PostCompact cannot revive cleaned status across three cleanup APIs. No equivalent replacement coverage is claimed.",
        "Audit1340 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1340 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/agent-hooks/manual-compact-status-cleanup.test.ts\",\n    \"assertions\": [\n      \"pane, tab, and server cleanup revoke compact completion authority\"\n    ]\n  }\n]",
        "Audit1610 retains this receipt as historical scope only after removing the gate’s last active assertion reference. Receipt fields preserved verbatim:\n{\n  \"date\": \"2026-08-17\",\n  \"runner\": \"manual\",\n  \"platform\": \"macos\",\n  \"command\": \"Manual Claude Code interactive compact under a PTY: register every hook to a logging script, run one turn then /compact to observe the abort stream, then seven turns and /compact to observe the success stream; compare source, trigger, session_id, and prompt_id across both\",\n  \"result\": \"passed\",\n  \"durationSeconds\": 1080,\n  \"summary\": \"Claude Code 2.1.227. Aborted compact emitted PreCompact(manual) ALONE with no PostCompact and no SessionStart(compact). Successful compact emitted PreCompact(manual), a start-less SubagentStop (agent_type empty, no matching SubagentStart), SessionStart(source=compact), PostCompact(manual), then Notification(idle_prompt). /compact emitted no UserPromptSubmit in either the TUI or print mode; session_id was stable across the whole window while the compact allocated its own prompt_id.\"\n}"
      ],
      "demotionRule": "Demote or quarantine if identity-mismatched completion can retire newer work, cleanup retains compact authority, or the focused gate flakes without a product or harness bug."
    },
    {
      "id": "agent-launch.discovery-authority",
      "title": "Agent discovery and launch use the same workspace authority",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "agent-session",
      "layer": "renderer-store-contract",
      "surfaces": ["Quick Launch agent inventory", "agent launch", "Floating Workspace"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "wsl", "ssh", "remote-runtime"],
      "coveredPlatforms": ["windows"],
      "coveredProviders": [],
      "coverageNotes": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2371 reduces repos-project-group-create-race.test.ts by removing the two-host generic failed-create-response/no-op example. Its alarm that a failed create reply leaves an intervening refreshed state untouched is intentionally lost. The surviving refreshed-field and original-owner races do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced source; unrelated physical Windows/WSL receipt retains its original command and scope. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1396 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A deterministic Windows-mode renderer oracle keeps an active WSL project and explicit-local Floating Workspace mounted together with disjoint agent inventories, then independently asserts discovery and launch authority. A headed physical Windows 2 journey with real Ubuntu WSL2 independently verified the rendered inventory and native PowerShell launch; SSH and paired-runtime behavior retain their existing contract coverage. The test-value audit removes standalone WSL/provider argument inventories and basic supplied-result/cache-clear examples from detected-agents.test.ts. It retains shared in-flight detection, cached-context return, repair/retry, stale-response fencing, SSH refresh/pruning and old-server fallback behavior. These retained tests do not replace the removed route-argument alarms or execute a live WSL/remote probe. Historical commands, counts and results remain unchanged. The later test-value audit removes narrow refusal/reset ledgers, a settled-project eviction/reacquisition example, a simple stale-success variant and redundant plain-text draft cleanup examples. local-detected-agent-state retains independent inventory completion orders, preference-change fencing, full-refresh loading settlement, refresh failure/retry, native-versus-WSL separation, subscriber broadcast bounds and in-flight project eviction. The removed settled-context sibling-preservation/reacquisition alarm is intentionally lost; retained cases are not equivalent replacements and no live provider execution is claimed. Historical commands, counts and results remain unchanged. The test-value audit retires the standalone project-runtime registrar from repos-project-mutations.test.ts. Its updateProject runtime-preference example no longer checks clearing detectedAgentIds, isDetectingAgents and isRefreshingAgents or dispatch of orca:installed-agent-skills-changed. This narrow invalidation alarm is lost; no equivalent replacement is claimed. Historical executed commands, counts and results remain unchanged. Audit1342: src/renderer/src/hooks/useAgentDetectionTarget.test.ts removed. Floating/runtime/hydration/stamped owner key selection, scanning count and malformed decode fallback matrices disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4027/p1-floating-workspace-agent-detection-still-uses-active-wsl-project",
        "https://github.com/stablyai/orca/pull/13995"
      ],
      "invariant": "Every agent launch surface must advertise the provider set detected on its explicit execution authority and launch on that same authority; a local Floating Workspace must never inherit an unrelated active project's WSL, SSH, or paired-runtime context.",
      "oracle": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2371 reduces repos-project-group-create-race.test.ts by removing the two-host generic failed-create-response/no-op example. Its alarm that a failed create reply leaves an intervening refreshed state untouched is intentionally lost. The surviving refreshed-field and original-owner races do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced source; unrelated physical Windows/WSL receipt retains its original command and scope. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Model an active WSL project and a native-Windows Floating Workspace with WSL-only Claude and host-only Codex. Keep both detection consumers mounted, require their advertised sets to stay disjoint through refresh, require the legacy active-project inventory to remain unchanged, then independently assert the Floating launch call and PTY transport select local IPC with no WSL project runtime.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts src/renderer/src/store/projects/repos-project-host-capability.test.ts src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts src/renderer/src/store/repos/repos-update-serialization.test.ts --reporter=verbose",
        "Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace"
      ],
      "testFiles": [
        "src/renderer/src/hooks/useDetectedAgents.test.tsx",
        "src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts",
        "src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts",
        "src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts",
        "src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts",
        "src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts",
        "src/renderer/src/store/projects/repos-project-host-capability.test.ts",
        "src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts",
        "src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts",
        "src/renderer/src/store/repos/repos-update-serialization.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/hooks/useDetectedAgents.test.tsx",
          "assertions": [
            "the active WSL project advertises only its WSL agent while Floating advertises only the native-host agent",
            "Floating refresh preserves both scoped inventories and does not overwrite the legacy active-project inventory"
          ]
        },
        {
          "file": "src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts",
          "assertions": [
            "same-context callers deduplicate without cached broadcast fanout",
            "refresh supersedes stale detection and failed cold refresh remains retryable",
            "project removal evicts in-flight context state"
          ]
        },
        {
          "file": "src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts",
          "assertions": [
            "removing one project evicts its authority-scoped agent inventory without disturbing another project"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-12",
          "runner": "manual",
          "platform": "windows",
          "command": "Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace",
          "result": "passed",
          "durationSeconds": 22.3,
          "summary": "Environment abfee683-80eb-4ac3-ada0-da5d1b6303a6, runtime b3bea13e-f6b7-41e7-b850-0a118f7eda38: Floating advertised native Claude/Codex without WSL-only Gemini and launched Claude through native PowerShell with local host ownership while the WSL project remained active."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 40,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Changed selectors have no new soak result after Audit1396; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic oracle uses mocked provider results and React effect barriers. Exact-head PR run 31644438349 passed the full Node 24/26 matrix; an earlier patch-identical run's transient shard failures passed on rerun, but long-term soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1396 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The byte-identical oracle fails on merged PR #13995 and the tested latest-main snapshot ebe5125476 because Floating receives the WSL-only Claude inventory while launch remains local. The candidate passes; disabling the scoped Floating target reproduces the mismatch."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Floating uses one stable host context key, retained tab bars do not rescan worktree indexes on store writes, concurrent probes deduplicate per context, and in-flight promise entries are deleted on settlement."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Keep the physical Windows/WSL inventory and launch journey green when authority routing changes.",
        "Keep disjoint provider inventories, refresh isolation, launch authority, and bounded in-flight state green."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/spawn/pty-connection-split-spawn.spec.ts. Intentionally lose these named regression alarms without replacement: clears the mobile-fit pane binding when the pane connection is disposed — Pane dispose clearing the mobile-fit binding and PTY dataset loses this direct example.; continues post-spawn size reconcile after a transient mobile presence lock — Size reconciliation continuing after a transient phone-presence lock loses this direct example.; spawns the delayed primary pane of an issue-command split when its sibling owns the tab PTY fallback — Delayed primary split spawning independently after a sibling acquires tab fallback loses this direct example.; does not reuse a sibling split pane pending spawn after remount — Remounted primary adopting its own pending PTY rather than the sibling spawn loses this direct example.; replays a stable-pane adoption without submitting the resume command — Stable-pane adoption replay preserving replay-before-live ordering and suppressing resume command loses this direct example.; forwards focus and hover reports without claiming a parked mirror (#26469) — Passive focus/hover forwarding without stealing mirror ownership, then intended Ctrl+C/click claiming, loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts src/renderer/src/store/projects/repos-project-host-capability.test.ts src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts src/renderer/src/store/repos/repos-update-serialization.test.ts src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts --reporter=verbose\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n        \"Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace\"\n      ]\ntestFiles: [\n        \"src/renderer/src/hooks/useDetectedAgents.test.tsx\",\n        \"src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts\",\n        \"src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts\",\n        \"src/renderer/src/store/projects/repos-project-host-capability.test.ts\",\n        \"src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts\",\n        \"src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts\",\n        \"src/renderer/src/store/repos/repos-update-serialization.test.ts\",\n        \"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/hooks/useDetectedAgents.test.tsx\",\n          \"assertions\": [\n            \"the active WSL project advertises only its WSL agent while Floating advertises only the native-host agent\",\n            \"Floating refresh preserves both scoped inventories and does not overwrite the legacy active-project inventory\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts\",\n          \"assertions\": [\n            \"same-context callers deduplicate without cached broadcast fanout\",\n            \"refresh supersedes stale detection and failed cold refresh remains retryable\",\n            \"project removal evicts in-flight context state\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts\",\n          \"assertions\": [\n            \"removing one project evicts its authority-scoped agent inventory without disturbing another project\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\",\n          \"assertions\": [\n            \"the advertised Floating agent launches in a Floating tab with null runtime ownership and no paired-runtime create call\"\n          ]\n        }\n      ]",
        "Audit3069 retires nominal spawn/resume/banner wiring, first-fit and lookup-budget variants, private pending-map checks, the split-CWD disposal suite and startup command/draft baseline variants. Distinct regression alarms are intentionally lost without equivalent replacement; retained ownership, cancellation and recovery cases remain. Existing selectors and dated evidence retain their original scope. The retired Floating local IPC/WSL routing alias is removed; the separate StrictMode pending-spawn adoption alias remains.",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Live SSH and paired-runtime launch journeys are covered by existing authority contracts rather than this focused oracle.",
        "The test-value audit removes standalone WSL/provider argument inventories and basic supplied-result/cache-clear examples from detected-agents.test.ts. It retains shared in-flight detection, cached-context return, repair/retry, stale-response fencing, SSH refresh/pruning and old-server fallback behavior. These retained tests do not replace the removed route-argument alarms or execute a live WSL/remote probe. Historical commands, counts and results remain unchanged.",
        "The later test-value audit removes narrow refusal/reset ledgers, a settled-project eviction/reacquisition example, a simple stale-success variant and redundant plain-text draft cleanup examples. local-detected-agent-state retains independent inventory completion orders, preference-change fencing, full-refresh loading settlement, refresh failure/retry, native-versus-WSL separation, subscriber broadcast bounds and in-flight project eviction. The removed settled-context sibling-preservation/reacquisition alarm is intentionally lost; retained cases are not equivalent replacements and no live provider execution is claimed. Historical commands, counts and results remain unchanged.",
        "The test-value audit retires the standalone project-runtime registrar from repos-project-mutations.test.ts. Its updateProject runtime-preference example no longer checks clearing detectedAgentIds, isDetectingAgents and isRefreshingAgents or dispatch of orca:installed-agent-skills-changed. This narrow invalidation alarm is lost; no equivalent replacement is claimed. Historical executed commands, counts and results remain unchanged.",
        "Audit1342: src/renderer/src/hooks/useAgentDetectionTarget.test.ts removed. Floating/runtime/hydration/stamped owner key selection, scanning count and malformed decode fallback matrices disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts src/renderer/src/lib/local-preflight-context.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2,\n          \"summary\": \"Seven focused files passed independent WSL/local inventory, refresh isolation, cache lifecycle, project eviction, and Floating launch-call assertions. Historical command preserved after removal of the selector-only local-preflight suite in the test-value audit; currentCommand names the remaining suites only. This historical result has not been rerun for that command and does not claim equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-project-mutations.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"windows\"],\"coveredProviders\":[\"local\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed.",
        "Audit1396 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 20,\n          \"summary\": \"The full PTY connection suite passed the independent Floating native-host transport oracle.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts --reporter=dot\"\n        }",
        "Audit1396 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"windows\"],\"coveredProviders\":[\"local\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit2371 reduces repos-project-group-create-race.test.ts by removing the two-host generic failed-create-response/no-op example. Its alarm that a failed create reply leaves an intervening refreshed state untouched is intentionally lost. The surviving refreshed-field and original-owner races do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced source; unrelated physical Windows/WSL receipt retains its original command and scope.",
        "Finite R02 ownership closure retires all three cases from pty-connection/spawn/pty-connection-fresh-spawn-guards.spec.ts and its empty aggregate registration. Intentionally lost alarms: deletion-phase fresh-spawn admission; wrapped worktree-removal fence error suppression; classified typing versus synthetic query/mouse/alternate-wheel replay input, normal-arrow preservation, deferred input provenance and post-replay restoration. No equivalent replacement coverage, new execution, real PTY delivery or CI claim. Historical receipts and their original commands/counts/results remain historical and do not validate the reduced selector.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts src/renderer/src/store/projects/repos-project-host-capability.test.ts src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts src/renderer/src/store/repos/repos-update-serialization.test.ts src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts --reporter=verbose\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n        \"Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace\"\n      ]\ntestFiles: [\n        \"src/renderer/src/hooks/useDetectedAgents.test.tsx\",\n        \"src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts\",\n        \"src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts\",\n        \"src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts\",\n        \"src/renderer/src/store/projects/repos-project-host-capability.test.ts\",\n        \"src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts\",\n        \"src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts\",\n        \"src/renderer/src/store/repos/repos-update-serialization.test.ts\",\n        \"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/hooks/useDetectedAgents.test.tsx\",\n          \"assertions\": [\n            \"the active WSL project advertises only its WSL agent while Floating advertises only the native-host agent\",\n            \"Floating refresh preserves both scoped inventories and does not overwrite the legacy active-project inventory\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts\",\n          \"assertions\": [\n            \"same-context callers deduplicate without cached broadcast fanout\",\n            \"refresh supersedes stale detection and failed cold refresh remains retryable\",\n            \"project removal evicts in-flight context state\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts\",\n          \"assertions\": [\n            \"removing one project evicts its authority-scoped agent inventory without disturbing another project\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\",\n          \"assertions\": [\n            \"the advertised Floating agent launches in a Floating tab with null runtime ownership and no paired-runtime create call\"\n          ]\n        }\n      ]",
        "Renderer direct-owner cleanup retires the complete launch-agent-in-new-tab suite (six registrations/ten examples). Lost alarms cover child cwd/trust scope, captured host/selection ownership and creation settlement, precreation refusal, canonical args/model fallback, oversized Windows draft paste, and late-SSH status fencing. Owning private capability fixture state was consumed. No equivalent replacement, fresh execution, native process/provider, rendered UI, performance, or cross-platform result is claimed. Other source mappings and the existing independent manual Windows receipt keep their prior scope; retained shortcut/SourceControl/continuation cases do not replace these alarms. Historical removed active mappings (verbatim semantic values; no longer active): [{\"field\":\"testFiles\",\"previous\":[\"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\"]},{\"field\":\"assertionRefs\",\"previous\":[{\"file\":\"src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts\",\"assertions\":[\"the advertised Floating agent launches in a Floating tab with null runtime ownership and no paired-runtime create call\"]}]},{\"field\":\"commands\",\"previous\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/store/slices/agent-inventory/detected-agents.test.ts src/renderer/src/store/slices/agent-inventory/local-detected-agent-state.test.ts src/renderer/src/store/project-groups/repos-project-group-create-race.test.ts src/renderer/src/store/project-groups/repos-project-groups-delete.test.ts src/renderer/src/store/project-groups/repos-project-groups-owner-routing.test.ts src/renderer/src/store/projects/repos-project-host-capability.test.ts src/renderer/src/store/projects/repos-project-host-lifecycle.test.ts src/renderer/src/store/repos/repos-remove-project-purge-leak.test.ts src/renderer/src/store/repos/repos-update-serialization.test.ts src/renderer/src/lib/agent-session/launch/new-tab/launch-agent-in-new-tab.test.ts --reporter=verbose\"]}]"
      ],
      "demotionRule": "Demote if discovery and launch can resolve different authorities, a scoped Floating probe overwrites the active-project inventory, or local context selection adds recurring scans or retained in-flight entries."
    },
    {
      "id": "agent-session.opencode2-hook-cleanup",
      "title": "OpenCode 2 setup releases acquired hook owners after failure",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-integrations",
      "layer": "main-unit",
      "surfaces": ["OpenCode 2 generated plugin setup and unload"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1390 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Actual generated wrapper with synthetic factories, prompt registrations and event iterators. Supporting generated-module tests cover both OpenCode variants; no native provider execution. Audit1390: src/main/opencode2/status-plugin-setup-lifetime.test.ts reduced. Ordinary unload count, optional-disposer and factory-allocation defaults removed; no live OpenCode runtime integration claimed. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/opencode2/status-plugin-setup-source.ts"
      ],
      "invariant": "After a hook factory is acquired, prompt registration failure or a throwing/rejecting prompt disposer cannot skip hook disposal. Unload waits for in-flight event delivery before disposing the hook factory and remains fail-open.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1390 retired changed-source receipts. Historical oracle account: Fault-injected setup and unload each call hook disposal once. The ordered control completes delivery and subscription before hook cleanup. Normal unload disposes both owners once.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1390 retired changed-source receipts; reduced selector has no new soak result. Historical account: Local deterministic validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1390 changed referenced test sources; no new red/green validation. Historical account: Baseline seven failures and three controls; candidate ten passed. Hook disposal after prompt registration/cleanup failure changes from zero to one."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1390 changed test sources; no new measurement. Previous account: No new polling, scans, subprocesses or successful-startup awaits. Failure paths now await the existing hook disposer; teardown retains event-delivery ordering. No latency or heap improvement claimed."
      },
      "knownGaps": [
        "Native Linux/Windows, SSH/WSL and remote-runtime plugin execution not run.",
        "Local/daemon PTY and mobile/relay transport behavior is unaffected.",
        "Pending non-abortable registration, event delivery or disposal promises can still delay cleanup; no timeout or cancellation redesign.",
        "Malformed form normalization remains a separate defect.",
        "CI soak pending.",
        "Audit1390: src/main/opencode2/status-plugin-setup-lifetime.test.ts reduced. Ordinary unload count, optional-disposer and factory-allocation defaults removed; no live OpenCode runtime integration claimed. No equivalent replacement coverage is claimed.",
        "Audit1390 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-26\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.125,\n          \"summary\": \"10 permanent cases pass; baseline seven fail and three controls pass. Fresh-main run including existing setup/lineage suites: 59 pass.\"\n        }",
        "Audit1390 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1390 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/opencode2/status-plugin-setup-lifetime.test.ts\",\n    \"assertions\": [\n      \"disposes the factory after prompt registration %s\",\n      \"disposes the factory after prompt cleanup %s\",\n      \"waits for in-flight delivery before factory cleanup after a prompt cleanup failure\"\n    ]\n  }\n]",
        "Audit1390 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/opencode2/status-plugin-setup-lifetime.test.ts\",\n          \"assertions\": [\n            \"disposes the factory after prompt registration %s\",\n            \"disposes the factory after prompt cleanup %s\",\n            \"waits for in-flight delivery before factory cleanup after a prompt cleanup failure\"\n          ]\n        }\n      ]",
        "Audit1390 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts\"],\"testFiles\":[\"src/main/opencode2/status-plugin-setup-lifetime.test.ts\"]}"
      ],
      "promotionCriteria": [
        "Retain cleanup-count and delivery-order oracles; add provider/platform execution and CI soak."
      ],
      "demotionRule": "Keep experimental until soak; investigate failures without weakening cleanup or delivery-order assertions."
    },
    {
      "id": "agent-session.provider-ownership",
      "title": "Provider sessions are resumed once per workspace ownership claim",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session",
      "layer": "cross-boundary",
      "surfaces": [
        "agent launch",
        "workspace activation",
        "sleep and hibernate restore",
        "provider session dedupe",
        "sidebar and mobile identity",
        "runtime-owned background PTY mount and remount"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3368 retires whole sleeping-agent-resume and host-session-launch suites: provider-claim/deduplication, stable-pane reattach, recipe/WSL startup, callback/cancel/create-close and compatibility examples are intentionally lost without equivalent replacement. The sole dated receipt is retired verbatim. With no active evidence, protection/platform/provider evidence clears and ALL commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps, including selectors of surviving other sources; those sources remain in the broad suite. Prior red/green/flake accounts are historical only. No fresh runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit2236: pane-fit.test.ts is reduced to terminal-identity reveal, stale-handle replacement ownership and withheld-animation-frame completion. The existing withheld-frame assertion remains exact; additional scheduling/breadcrumb, cancellation, display-none and synthetic metric examples are removed. No new execution or equivalent replacement coverage is claimed. Historical dated receipts and budgets are preserved verbatim and do not validate these reduced source bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1685 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6800",
        "https://github.com/stablyai/orca/pull/5240",
        "https://github.com/stablyai/orca/pull/6411",
        "https://github.com/stablyai/orca/pull/6833",
        "https://github.com/stablyai/orca/pull/11789",
        "https://github.com/stablyai/orca/pull/11819"
      ],
      "invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, mount, remount, and reconnect code must not replay or resume a provider session id already owned, queued, pending, live, or durably bound to a host PTY in that workspace. A renderer with missing projection state must adopt the exact runtime-owned PTY for the original tab and leaf rather than create a replacement.",
      "oracle": "Audit3368 retires whole sleeping-agent-resume and host-session-launch suites: provider-claim/deduplication, stable-pane reattach, recipe/WSL startup, callback/cancel/create-close and compatibility examples are intentionally lost without equivalent replacement. The sole dated receipt is retired verbatim. With no active evidence, protection/platform/provider evidence clears and ALL commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps, including selectors of surviving other sources; those sources remain in the broad suite. Prior red/green/flake accounts are historical only. No fresh runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Current assertionRefs retain separate provider-session non-replay and exact-PTY adoption checks in resume-sleeping-agent-session, completed-worker-retirement-resume, remote-runtime-pty-transport-host-session-launch and live-background-terminal-mount-authority. This batch changes only pane-fit's contribution: its three surviving cases check terminal-identity reveal, stale-handle replacement and withheld-frame completion; they do not prove provider-session ownership or exact-PTY adoption. Other assertionRefs and selectors remain unchanged; no fresh execution of those separate contracts is claimed. Audit2236: pane-fit.test.ts is reduced to terminal-identity reveal, stale-handle replacement ownership and withheld-animation-frame completion. The existing withheld-frame assertion remains exact; additional scheduling/breadcrumb, cancellation, display-none and synthetic metric examples are removed. No new execution or equivalent replacement coverage is claimed. Historical dated receipts and budgets are preserved verbatim and do not validate these reduced source bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit1685 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "focused renderer/main/provider contracts plus one isolated Electron mount-and-reload journey"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit3368 retires sole active dated receipt. No fresh execution/soak validates current coverage; complete original account preserved verbatim as history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit3368 changes/deletes referenced sources. No fresh red/green proof validates reduced coverage; original complete account preserved verbatim in knownGaps as history."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Renderer state tests assert bounded provider-session indexing. Stable-pane adoption is a targeted owner lookup and attach-only call; focused contracts require no provider listing scan, fresh spawn callback, or repeated resume probe. The Electron oracle checks exact launch counts but is not a throughput benchmark."
      },
      "promotionCriteria": [
        "Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Add bounded-work assertions for delayed hook/status ownership scans if those paths grow.",
        "Attach red/green evidence that display/replay evidence alone cannot claim ownership.",
        "Record byte-identical latest-main, candidate, and candidate-revert Electron results."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-stale-daemon-snapshot-replay.spec.ts. Intentionally lose these named regression alarms without replacement: clears the captured pen for a normal-buffer fallback reattach — Fallback normal-buffer reattach clearing captured pen and dirty background loses this direct example.; waits for a recovered destination fit before forwarding its grid or live output — Recovered destination fitting before forwarding grid or live output loses this direct example.; suppresses the deferred reattach grid push when mobile claims the PTY while hidden — Mobile takeover while hidden suppressing deferred reattach grid forwarding loses this direct example.; drops stale callbacks but delivers fresh replacement output after an old replay clear — Fresh replacement output winning over stale callbacks after old replay clear loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts src/main/providers/local-pty/local-pty-provider-spawn-session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/ipc/pty/pty-pane-reservation-settlement.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n        \"pnpm exec electron-vite build --mode e2e && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/live-background-terminal-mount-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers.test.ts src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts src/main/providers/agent-foreground-process-git-bash.win32.test.ts\"\n      ]\ntestFiles: [\n        \"src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n        \"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\n        \"src/main/providers/local-pty/local-pty-provider-spawn-session.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"src/main/ipc/pty/pty-pane-reservation-settlement.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n        \"tests/e2e/live-background-terminal-mount-authority.spec.ts\",\n        \"src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers.test.ts\",\n        \"src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts\",\n        \"src/main/providers/agent-foreground-process-git-bash.win32.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts\",\n          \"assertions\": [\"captures source before routing (unary=%s)\"]\n        },\n        {\n          \"file\": \"src/main/providers/agent-foreground-process-git-bash.win32.test.ts\",\n          \"assertions\": [\"sets aside a detached ssh-agent for adoption, but not a background job\"]\n        },\n        {\n          \"file\": \"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\n          \"assertions\": [\n            \"completed and explicitly retired workers retain no provider-resume authority on first workspace activation\",\n            \"the original tab, leaf, PTY, provider session, release state, replacement count, queued resume argv, emitted restored banner, and unrelated canary remain exact across restart\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n          \"assertions\": [\n            \"preserved panes claim their provider session and only stale duplicates are cleared\",\n            \"one launch per provider session: skipped duplicates are cleared instead of relaunched\",\n            \"active stable-pane records owned by preserved or visible panes are not resumed again\",\n            \"hibernated stable panes with cleared live PTY bindings are skipped\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"same-generation explicit reattach drains the authoritative snapshot before immediate live bytes and ACKs their delivery credit\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n          \"assertions\": [\n            \"paired-runtime stable-pane adoption reports reattach without fresh-spawn ownership\",\n            \"cancellation after a paired-runtime adoption cannot close the original owner\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/live-background-terminal-mount-authority.spec.ts\",\n          \"assertions\": [\n            \"first mount and renderer reload preserve exact agent and Setup handle, PTY, incarnation, tab, leaf, and PID identity\",\n            \"PID-specific keyboard input and output remain user-visible in both mounted panes\",\n            \"runtime inventory, renderer graph, persisted session, runtime epoch, and daemon PID converge without replacement or resume\",\n            \"the unrelated canary remains writable and receives no signal across target projection repair\"\n          ]\n        }\n      ]",
        "Audit3053 reduces hidden-replay coverage by retiring nominal overlap, resize, cursor metadata and standalone stalled-restore variants. Timeout, overflow, identity/generation fences and retained live-output coordination remain; the removed alarms are intentionally lost without equivalent replacement. Existing commands, assertion references and dated evidence retain their original scope.",
        "Audit2236: pane-fit.test.ts is reduced to terminal-identity reveal, stale-handle replacement ownership and withheld-animation-frame completion. The existing withheld-frame assertion remains exact; additional scheduling/breadcrumb, cancellation, display-none and synthetic metric examples are removed. No new execution or equivalent replacement coverage is claimed. Historical dated receipts and budgets are preserved verbatim and do not validate these reduced source bytes.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1685 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Providers listed on this gate are affected identity surfaces; live integration is limited to local macOS while daemon and remote-runtime adoption also have focused contracts.",
        "The Electron oracle seeds the production hook-store contract instead of running an authenticated Codex hook end to end.",
        "The live Electron topology is local macOS only; folder workspaces, SSH, WSL, paired headed/headless servers, Linux, and Windows are not exercised by that journey.",
        "The oracle covers first activation and one renderer reload, not repeated soak activation or an installed-app update.",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/lib/pane-manager/pane-fit.test.ts. Lost alarms: runs the continuation when the reveal fit arrives on a different pane object; does not let a stale handle cancel its deferred replacement; resolves failure when hidden-window animation frames are withheld. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope.",
        "Audit3368 retires whole sleeping-agent-resume and host-session-launch suites: provider-claim/deduplication, stable-pane reattach, recipe/WSL startup, callback/cancel/create-close and compatibility examples are intentionally lost without equivalent replacement. The sole dated receipt is retired verbatim. With no active evidence, protection/platform/provider evidence clears and ALL commands/testFiles/assertionRefs are retired as complete original arrays in historical gaps, including selectors of surviving other sources; those sources remain in the broad suite. Prior red/green/flake accounts are historical only. No fresh runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3368 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts src/main/providers/local-pty/local-pty-provider-spawn-session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/ipc/pty/pty-pane-reservation-settlement.test.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n        \"pnpm exec electron-vite build --mode e2e && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/live-background-terminal-mount-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers.test.ts src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts src/main/providers/agent-foreground-process-git-bash.win32.test.ts\"\n      ]",
        "Audit3368 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        \"src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n        \"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\n        \"src/main/providers/local-pty/local-pty-provider-spawn-session.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"src/main/ipc/pty/pty-pane-reservation-settlement.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n        \"tests/e2e/live-background-terminal-mount-authority.spec.ts\",\n        \"src/main/runtime/agent-session/lifecycle/structured-agent-cli-writers.test.ts\",\n        \"src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts\",\n        \"src/main/providers/agent-foreground-process-git-bash.win32.test.ts\"\n      ]",
        "Audit3368 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        {\n          \"file\": \"src/main/runtime/rpc/methods/structured-sessions/creation/structured-agent-session-adoption-replay.test.ts\",\n          \"assertions\": [\"captures source before routing (unary=%s)\"]\n        },\n        {\n          \"file\": \"src/main/providers/agent-foreground-process-git-bash.win32.test.ts\",\n          \"assertions\": [\"sets aside a detached ssh-agent for adoption, but not a background job\"]\n        },\n        {\n          \"file\": \"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\n          \"assertions\": [\n            \"completed and explicitly retired workers retain no provider-resume authority on first workspace activation\",\n            \"the original tab, leaf, PTY, provider session, release state, replacement count, queued resume argv, emitted restored banner, and unrelated canary remain exact across restart\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\",\n          \"assertions\": [\n            \"preserved panes claim their provider session and only stale duplicates are cleared\",\n            \"one launch per provider session: skipped duplicates are cleared instead of relaunched\",\n            \"active stable-pane records owned by preserved or visible panes are not resumed again\",\n            \"hibernated stable panes with cleared live PTY bindings are skipped\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"same-generation explicit reattach drains the authoritative snapshot before immediate live bytes and ACKs their delivery credit\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\",\n          \"assertions\": [\n            \"paired-runtime stable-pane adoption reports reattach without fresh-spawn ownership\",\n            \"cancellation after a paired-runtime adoption cannot close the original owner\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/live-background-terminal-mount-authority.spec.ts\",\n          \"assertions\": [\n            \"first mount and renderer reload preserve exact agent and Setup handle, PTY, incarnation, tab, leaf, and PID identity\",\n            \"PID-specific keyboard input and output remain user-visible in both mounted panes\",\n            \"runtime inventory, renderer graph, persisted session, runtime epoch, and daemon PID converge without replacement or resume\",\n            \"the unrelated canary remains writable and receives no signal across target projection repair\"\n          ]\n        }\n      ]",
        "Audit3368 historical original evidenceRuns object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\n        {\n          \"date\": \"2026-07-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.9,\n          \"summary\": \"1 test file(s) passed, 30 tests passed on main@1282f5c2d in a clean checkout.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/agent-session/resume/resume-sleeping-agent-session.test.ts\"\n        }\n      ]",
        "Audit3368 historical original protection object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"partial\"",
        "Audit3368 historical original coveredPlatforms object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"macos\"]",
        "Audit3368 historical original coveredProviders object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n[\"local\", \"daemon\", \"remote-runtime\"]",
        "Audit3368 historical original redGreenEvidence object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"missing\",\n        \"evidence\": \"Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Renderer tests encode provider-session dedupe across active, inactive, queued, and live claims. The cross-boundary Electron oracle is constructed for byte-identical latest-main, candidate, and candidate-revert runs; record those three terminal results before promoting this gate.\"\n      }",
        "Audit3368 historical original flakeHistory object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n        \"status\": \"unknown\",\n        \"evidence\": \"The renderer gate has prior local evidence; the stable-pane Electron oracle is new and needs CI soak before blocking promotion.\"\n      }"
      ],
      "demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix."
    },
    {
      "id": "agent-session.remote-host-authority",
      "title": "Remote agent sessions have one host-authoritative PTY and durable surface lifecycle",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "agent-session",
      "layer": "runtime-controller-provider-renderer-contract",
      "surfaces": [
        "remote agent launch and explicit resume",
        "multi-client remote runtime sessions",
        "paired viewer-local structured agent focus",
        "headed desktop remote-server pairing",
        "headless remote-server parity",
        "daemon and relay reconnect",
        "remote completion classification across disconnect and reconnect",
        "terminal exit retirement and restart restore",
        "mixed-version fallback"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coverageNotes": "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1495 intentionally deletes the orphan-owner suite: explicit owner/host predicate examples are retired; no equivalent replacement coverage or fresh result is claimed. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/8878",
        "https://github.com/stablyai/orca/issues/9151",
        "https://github.com/stablyai/orca/issues/9352",
        "https://github.com/stablyai/orca/pull/9687",
        "https://github.com/stablyai/orca/issues/10192",
        "https://github.com/stablyai/orca/pull/10193"
      ],
      "invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.",
      "oracle": "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
        "pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs",
        "node --check config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs",
        "pnpm exec electron-vite build --mode e2e",
        "VITE_EXPOSE_STORE=true pnpm run build:web",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/construction/orca-runtime.test.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts"
      ],
      "testFiles": [
        "src/main/daemon/terminal-host/testing/terminal-host.test.ts",
        "src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts",
        "src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "tests/e2e/remote-agent-completion-authority.unit.test.ts",
        "src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts",
        "src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts",
        "src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts",
        "src/shared/claimed-agent-pty-owner.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts",
        "src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts",
        "src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts",
        "tests/e2e/remote-agent-session-focus-authority.spec.ts",
        "config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs",
        "config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs",
        "tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts",
        "src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts",
          "assertions": [
            "completion inspection rejects an unmapped session instead of borrowing the local fallback"
          ]
        },
        {
          "file": "tests/e2e/remote-agent-completion-authority.unit.test.ts",
          "assertions": [
            "transport loss remains unknown through reconnect and cannot dispatch completion",
            "returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples",
            "explicit stop, real exit status, and genuine successful completion remain distinct"
          ]
        },
        {
          "file": "src/shared/claimed-agent-pty-owner.test.ts",
          "assertions": [
            "concurrent exact claims spawn once and later callers adopt the canonical owner",
            "same identity in another worktree conflicts and cannot be found as the current scope's owner",
            "generation-guarded exit and authoritative reconciliation cannot retire a replacement owner"
          ]
        },
        {
          "file": "src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts",
          "assertions": [
            "independent runtime clients converge on one canonical live agent-session owner",
            "retries and concurrent requests cannot create a second physical PTY"
          ]
        },
        {
          "file": "src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts",
          "assertions": [
            "an exact PTY exit retires host membership and stale topology cannot recreate the surface",
            "incarnation fencing prevents an old delayed exit from retiring a replacement PTY"
          ]
        },
        {
          "file": "tests/e2e/remote-agent-session-focus-authority.spec.ts",
          "assertions": [
            "headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus",
            "legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor",
            "host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup"
          ]
        },
        {
          "file": "config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs",
          "assertions": [
            "headless focused fresh/resume requests create background host surfaces without a renderer window",
            "dropped committed responses replay the same operation identity without another tokened agent spawn",
            "exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup"
          ]
        },
        {
          "file": "config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs",
          "assertions": [
            "isolated daemon roots and captured descendants are verified dead before profile PID records are removed"
          ]
        },
        {
          "file": "tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
          "assertions": [
            "a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom",
            "one exact exit produces one same-epoch higher-version host publication and one durable persistence flush",
            "same-epoch stale publications cannot resurrect the retired surface after reconnect"
          ]
        },
        {
          "file": "src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts",
          "assertions": [
            "replays a snapshot that beat the RPC response and focuses the exact adopted leaf",
            "retains exact-leaf focus intent when a split sibling publishes first"
          ]
        },
        {
          "file": "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts",
          "assertions": ["mirrors a new CLI tab after old-host recovery when $name"]
        },
        {
          "file": "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts",
          "assertions": [
            "serializes a newer convergence snapshot after an in-flight adoption conflict"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-23",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 5.8,
          "summary": "After fresh Electron E2E and exposed-store web builds, the isolated headed desktop host plus separate paired web client passed fresh/resume activate true/false, exact non-tail legacy placement in host/mirror/DOM, host focus isolation, requester-only exact focus, writable agent and unrelated shell markers, unrelated survival, and terminal/tab/PTY/process cleanup.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-22",
          "runner": "manual",
          "platform": "macos",
          "command": "Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
          "result": "passed",
          "durationSeconds": 549,
          "summary": "The primary user topology used an isolated headed Orca desktop as the owning server and a separate paired Edge client. Host inspection reported Codex alive before, during, and after a page-scoped WebSocket fault; the client showed no completion toast, reconnected to the same live Codex TUI, and explicit stop restored the shell prompt with no child process.",
          "currentCommand": "Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop"
        },
        {
          "date": "2026-07-22",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
          "result": "failed",
          "durationSeconds": 3.11,
          "summary": "The exact cross-boundary oracle failed on pre-#9687 commit 2a32c5c9a because the retired publication still contained the pinned persisted terminal surface.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts"
        },
        {
          "date": "2026-07-22",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
          "result": "failed",
          "durationSeconds": 3.48,
          "summary": "The exact strengthened oracle failed on PR #9053 head d3a1d3047 because its stale-headless pruning retained the pinned persisted terminal surface.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts"
        },
        {
          "date": "2026-07-22",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
          "result": "passed",
          "durationSeconds": 3.18,
          "summary": "The same strengthened oracle passed on main@4fce2de49.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audits1301 and1308; any retained unchanged-source receipts apply only to their own commands. Historical account: New experimental gate with deterministic local coverage and no soak history yet."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audits1301 and1308 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Issue #10192 has byte-identical renderer-oracle evidence: origin/main@ee87bb38d (and earlier ef985ed80 and 94d3db4a2) fails activated fresh and resume rows by requesting focused host presentation, the PR client change passes all four rows, and disabling it turns the activated rows red again. The original PR still fails an old-client focused request against a new headless host; host-boundary normalization turns that mixed-version control green while trusted local callers remain focused. Issue #9151 has local red/green evidence for completion authority. The exact retirement oracle is red on pre-#9687 commit 2a32c5c9a and PR #9053 head d3a1d3047, and green on main@4fce2de49. Saved CI artifacts are still needed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Agent-session reconciliation runs only at explicit claim admission, dedupes concurrent provider listing, and adds no polling or renderer output work. Viewer focus reconciliation reuses the existing one post-create list and bounded intent map; same-version replay permits one already-received snapshot, and exact-leaf matching adds one conditional scan over the bounded tab snapshot. Completion inspection reuses the coordinator's per-pane in-flight guard, global concurrency/rate queue, and existing error backoff; the strict daemon path reduces two foreground RPCs to one. Create-operation ledgers are capped globally and per client, expire after 24 hours, and reject rather than evict live replay fences. Capability caches are bounded or connection-scoped, and exact handoffs are consumed by the next authoritative snapshot."
      },
      "promotionCriteria": [
        "Run the focused gate and remote-server repro for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach saved red/green evidence for duplicate remote resume and exit-before-snapshot retirement.",
        "Run the automated headed Orca desktop-server and paired-client journey in required CI lanes; add a physical host when OS, ConPTY, update, sleep, firewall, or window lifecycle is causal.",
        "Add live SSH/WSL provider evidence before claiming full provider coverage; Docker SSH proves only the SSH provider/relay path."
      ],
      "knownGaps": [
        "Audit2694 intentional coverage losses (source-only, no replacement): src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-command-finished-interrupt-arbitration.spec.ts: 'drops the command-finished status when pending interrupt inference is rejected': Loses the standalone rejected-inference-to-drop alarm; the delayed-write rows remain but are not equivalent to this immediate rejection example. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'forwards raw onData after a bell as a query reply': Loses raw onData forwarding after the manually raised bell, including its hibernation-counter expectations. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-bell-query-reply-and-stale-input.spec.ts: 'blocks onData on a stale codex pane': The real isCodexPaneStale guard executes, and removing it would allow the typed a to reach transport. Intentionally loses this genuine stale-account typing refusal alarm. No retained query-reply test is claimed equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'omits byte-parser callbacks from the local transport options': Loses local main-authority callback omission and lifecycle callback presence checks. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'keeps byte-parser callbacks on remote-runtime transports': Loses remote-runtime parser callback preservation and factory-argument alarm, including this compatibility boundary; no mixed-version execution is covered. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'consumes pty:sideEffect facts with the live-path policy after spawn': Loses title/bell fact routing and exact 250ms delayed fake notification example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'schedules the completion notification for genuine working→idle facts': Loses positive main-fact working-to-idle scheduling alarm. Retained stale/race cases do not replace this positive example. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'drops the agent status from a command-finished fact like the byte path did': Loses command-finished fact-to-drop routing and removeAgentStatus noncall alarm. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'routes pr-link facts to the worktree PR observer': Loses PR-link fact forwarding, worktree/tab/PTY arguments alarm; retained raw-byte nonconsumption is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'seeds and settles Command Code status from command-code facts': Real Command Code seed/settle policy runs. Loses positive seed, prompt payload, and 1499+1ms completion boundary alarm; retained newer-working cancellation is not equivalent. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-main-side-effect-authority.spec.ts: 'does not byte-scan Command Code output — facts are the only consumer': Loses Command Code-specific no-byte-parser alarm. Retained PR/OSC raw-byte exclusion does not cover this parser. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-notification-settings-gating.spec.ts: 'shares one raw store subscriber for agent-complete notification settings across panes': Actual shared subscribe/unsubscribe runs. Loses shared single-subscription and final-pane unsubscribe lifetime alarm, with no replacement claimed. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'dispatches agent-task-complete for generic Codex spinner titles after process identity is confirmed': Real coordinator evidence path runs over fake process answers. Loses positive generic-title/confirmed-Codex completion and inspectProcess-argument alarm. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-task-complete-dispatch.spec.ts: 'normalizes Pi-compatible remote titles to authoritative OMP launch identity': Real owner-compatible normalization runs. Loses Pi-to-OMP title/status normalization, active tab label, OSC observation, and retained launch-identity example; no real remote transport or equivalent replacement. Wrapper cleanup removes only the deleted bell factory import and its registration-only describe block; no additional authored removal credit. Audit2694 source-only review: Remove14 authored/14 expanded cases in the renderer completion wrapper family, including the complete bell/query-reply/stale-input factory, without replacement. Retain29 authored/34 expanded cases with unchanged callback bodies. Three removals are the existing pending2203 overlap and must be adopted/count-reconciled once; eleven are fresh removals. No current-source runtime or gate execution is supplied by this packet; dated evidence retains its original source scope and does not validate the reduced factory bytes. No equivalent replacement, physical provider, mixed-version, mobile, rendered UI, cross-platform, soak or measured-performance result is claimed. The existing command and testFiles selector retain tests/pty-connection-completion-and-notification.test.ts; no wrapper-specific assertionRef is removed. Historical selector results do not validate its changed reachable factories.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The primary headed macOS desktop-server journey is automated locally but not yet run in CI; Windows and Linux window, ConPTY, update, sleep/wake, and firewall behavior remain uncollected.",
        "Mixed-version pairings remain conservative only when the completion-aware client and strict-inspection host changes are both present; older peers retain their legacy classification behavior.",
        "The secondary headless parity harness runs on macOS with a local daemon-backed execution owner and independent short-lived encrypted RPC clients; two persistent viewer-store mirrors and reconnect ordering are joined deterministically in the cross-boundary unit test rather than mounted live.",
        "SSH and relay failure ordering is deterministic provider-contract coverage, not a live SSH-host journey or paired-Orca-server proof; WSL has no provider-specific run, and Linux and Windows runs remain uncollected.",
        "Fresh-launch operation replay is memory-backed and intentionally does not survive runtime restart; a durable operation journal is a documented future extension.",
        "Automatic sleep checkpoints, verified nested-SSH execution namespaces, and multi-process profile coordination remain outside v1.",
        "The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence.",
        "Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them.",
        "Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed.",
        "Audit1301 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-21\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.67,\n          \"summary\": \"Ten focused files and 325 tests passed after the final review fixes, covering claim scope, mixed-version Pi/SSH fallback ordering, operation replay, terminal retirement, causal inventory fencing, exact concurrent handoff confirmation, daemon-generation integration, transport behavior, and remote host integration.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts\"\n        }",
        "Audit1301 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts\",\n    \"assertions\": [\n      \"a causally post-operation inventory waits out an older request and concurrent confirmations share the fresh request\"\n    ]\n  }\n]",
        "Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1308 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts\",\n    \"assertions\": [\n      \"replaces only the provisional tab with an exact structured-create handoff\",\n      \"retires an exact provisional handoff only after a post-create snapshot confirms exit\"\n    ]\n  }\n]",
        "Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts src/renderer/src/lib/codex-session-restart.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 11.96,\n          \"summary\": \"Eleven focused files and 870 tests passed on the current-main candidate. The cross-boundary harness fails with the implementation reverted by dispatching process-exit from unavailable remote evidence. Direct SSH uses strict main-process inspection, daemon and relay inspection reject missing or unmapped sessions, the terminal lifecycle suite uses the atomic inspection boundary, and one stale pane cannot suppress restart notices for a separately confirmed Codex pane.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/lib/codex-session-restart.test.ts\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"wsl\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts\",\n    \"assertions\": [\n      \"completion polling uses the atomic process-inspection boundary without regressing established lifecycle behavior\"\n    ]\n  }\n]",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely\",\"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity\",\"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it\",\"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology\",\"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds\"]},{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely\",\"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity\",\"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it\",\"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology\",\"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds\"]}]",
        "Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts: Loses obsolete pending title process races, inspection failure suppression, explicit completion precedence and delayed remote inspection alarms. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1880 reduces agent-completion-coordinator-process-cadence.test.ts. Retained alarms exercise hidden unannounced exit detection, child-process exit refusal, exit-confirmation reset across two kinds of uncertain evidence, and replacement veto before coordinator mutation, using actual coordinator logic with simulated process evidence. Removed alarms are hidden-idle timer absence, literal hidden/visible 60-second polling counts, visibility-rearm call budget, non-agent spinner suppression after exit, separate unavailable-inspection hook/title evidence guards, replacement callback payload, and unconditional owner-veto suppression. These direct cadence/policy alarms are intentionally lost without equivalent replacement coverage. No active assertionRef names this source and none of this gate's active receipt command/currentCommand selectors includes it; all original receipts and coverage accounting remain unchanged. This note is not fresh execution, native process, remote-host, platform, soak or measured-budget evidence for the reduced selector.",
        "Audit1911: The complete provider PTY-inspection mock suite is removed: missing-provider rejection, stale-PTY renderer unverifiable mapping, preserved supplied renderer failures, and supplied transport-loss mapping alarms are intentionally lost. No actual terminal teardown, daemon error or remote transport was exercised. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Exact retired authored alarms: 'rejects a missing provider PTY instead of returning idle evidence'; 'returns client-only unverifiable to the renderer when a stale PTY is gone'; 'preserves non-stale renderer inspection failures'; 'returns client-only unverifiable when the provider loses transport'.",
        "Audit1911 historical original retired assertion object, preserved verbatim; this is not an active assertion mapping:\n{\n          \"file\": \"src/main/providers/pty-process-inspection.test.ts\",\n          \"assertions\": [\n            \"dedicated provider inspection preserves failures and rejects missing PTYs instead of returning idle evidence\"\n          ]\n        }",
        "Audit1931 (sources1928/1929): Partial agent-operation service suite retains only concurrent retry joining with changed-fingerprint conflict. Retire its complete three-title assertion object: old-owner legacy fallback before side effects, nested SSH Pi transcript refusal and completed/ambiguous physical-commit replay fences are no longer backed. Other probe/launch option/ledger/failure/remote-inventory examples disappear as detailed below. No actual provider spawn, live SSH or physical commit proof is retained by this source. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'calls the selected provider probe with its receiver and caller signal'; 'ensures existing %s with raw fallback and genuine picks, excluding fresh map'; 'retains compiled policy through args-only host reconstruction and repeated recorded resume'; 'propagates probe getter failure before entering the probe failure fallback'; 'captures the terminal callee before reading launch option getters'; 'suppresses startup updates only for auto-submitted launches: %s'; 'forwards renderer keyboard support on create and resume: %s'; 'refuses a changed keyboard capability under the same create operation'; 'selects legacy before spawn or ledger state for an old daemon'; 'shapes the launch for the route it resolved, not a repo row on another host'; 'requests exact client legacy fallback before nested SSH side effects'; 'waits for Codex shell launch preparation before a structured resume'; 'selects nested SSH legacy fallback before reading a Pi transcript path locally'; 'replays the same completed operation without spawning again'; 'joins reordered complete options and gives their resolved execution the same identity'; 'fences changed options, supplemental extras, and absent versus empty inputs'; 'compiles complete choices with host defaults, replacement Args and supplemental extras once'; 'isolates operation ids by authenticated caller'; 'starts a create however many unexpired operations are held, and still replays the first'; 'rejects an expired unseen operation before terminal creation'; 'releases a failed pre-spawn operation for a safe retry'; 'retains a replay fence when %s after physical spawn commit'; 'reclaims a fenced remote spawn the host is still holding'; 'replays the fenced failure when host inventory proves the spawn is gone'; 'replays the fenced failure when the remote host cannot answer'; 'refuses to adopt a same-handle PTY that belongs to another workspace'; 'retains a replay fence when the provider reports an unknown spawn outcome'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orca-runtime-agent-session-operation.test.ts\",\n          \"assertions\": [\n            \"old execution owners select exact legacy fallback before trust, spawn, or ledger mutation\",\n            \"nested SSH Pi resume selects legacy before reading the remote-only transcript path locally\",\n            \"fresh operation retries replay one result and retain a fence after an ambiguous physical commit\"\n          ]\n        }",
        "Audit1983: Delete the mocked agent-session suite and its prospective selector and aliases. Retire all3 whole dated changed-selector receipts, preserving their original raw objects in historical gaps without transferring counts or durations. Preserve5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/terminal/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/terminal/agent-session.test.ts\"",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/terminal/agent-session.test.ts\",\n          \"assertions\": [\n            \"authenticated runtime and mobile structured requests normalize focused presentation to background before reaching the owning runtime\",\n            \"trusted in-process structured callers retain focused presentation\"\n          ]\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/web-session-intent-owner.test.ts src/renderer/src/runtime/remote-server-parity.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.28,\n          \"summary\": \"Five focused files and 140 tests passed on the structural candidate, covering authenticated host presentation normalization, trusted local preservation, fresh/resume viewer intent, same-version response/publication replay, exact split-leaf focus, sibling-first publication, and paired-runtime parity.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/terminal/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts\"\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm test:repro:remote-agent-session\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 53.6,\n          \"summary\": \"The build-backed isolated headless serve harness passed over encrypted pairing. Tokened fresh/resume fixture processes were distinguished from unrelated Codex app-server startup probes; response-loss replay, exact spawn identity/count, writable PTYs, unrelated survival, stale rejection, exact PID death, empty restart inventory, and no session resurrection all passed.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/terminal/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts\"\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm test:repro:remote-agent-session\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 48.63,\n          \"summary\": \"The secondary build-backed headless parity harness passed post-rebase on main@72a2d7bc7 over encrypted WebSocket pairing with independent clients, proving one spawn, retry adoption, durable exit retirement, stale-publication rejection, and no restart resurrection.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/terminal/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts\"\n        }",
        "Audit2003: Delete the complete pure orphan-topology suite and its file membership; preserve the other selectors from its combined command after archiving the original command string. Lost alarms are synthetic current-layout preservation, one-anchor grafting and ambiguous-anchor appending examples. Do not transfer their ownership/topology scope to sibling suites. Preserve all5 independent historical receipts exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal/adoption/terminal-orphan-topology.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts --maxWorkers=1\"",
        "Audit2003 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/terminal/adoption/terminal-orphan-topology.test.ts\"",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionSshHookStatusAuthorityTests } from '../host-ownership/pty-connection-ssh-hook-status-authority.spec'; registerPtyConnectionSshHookStatusAuthorityTests(). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-ssh-hook-status-authority.spec.ts: leaves SSH IPC OSC 9999 status ownership in the main runtime. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Original prospective command before removal: pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-tabs-sync/inventory/web-runtime-session.test.ts",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/runtime/web-session-tabs-sync/inventory/web-runtime-session.test.ts. Lost alarms: confirms only the exact handoff after its post-create list completes. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope.",
        "Audit 3301 removes the caller-chat-target precedence over host selection example from web-session-tabs-sync-focus-intent.test.ts. The snapshot-before-RPC replay and split-sibling-first exact-leaf focus cases remain unchanged and match the existing assertion reference. Preserve current selectors, assertion references, unrelated active receipts and complete archived history. These mocked state-composition survivors provide no equivalent replacement, rendered, native, network or fresh execution proof.",
        "Audit3359 retires the whole create-handoff suite. Supplied disposition, late completion, close-callback and metadata-bookkeeping alarms are intentionally lost without equivalent replacement; the compound unit selector and test-file entry narrow accordingly. Five unrelated macOS receipts retain their original scope. No fresh runtime, process-deduplication, physical provider/network, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\"",
        "Audit3359 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\"",
        "Audit3368 retires the whole host-session-launch unit source, including host-authority/create/ensure/legacy/Kimi/refusal/draft/options/prompt/cancel/kill/shared-disconnect and passive-sleep output callback alarms, without equivalent replacement. Its unit command token and test-file entry retire. Five unrelated macOS receipts remain verbatim and keep only their original scope; no fresh changed-selector/runtime/provider/process/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3368 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\"",
        "Audit3368 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-session-launch.test.ts\"",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. The Codex restart suite and exact command/testFiles/assertionRef are removed; its mock account-change/remote-pane restart alarms are intentionally lost.  Earlier notes and dated/archived evidence retain original scopes.",
        "Complete prior commands before exact deleted selectors were pruned: [\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"node --check config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs && node config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"pnpm exec electron-vite build --mode e2e\",\"VITE_EXPOSE_STORE=true pnpm run build:web\",\"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\"Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts --maxWorkers=1\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/runtime/construction/orca-runtime.test.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\"]",
        "Complete prior testFiles before exact deleted selectors were pruned: [\"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\"src/main/daemon/providers/routing/testing/daemon-pty-router.test.ts\",\"src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"tests/e2e/remote-agent-completion-authority.unit.test.ts\",\"src/renderer/src/runtime/hosted-terminals/inspection/runtime-terminal-inspection.test.ts\",\"src/renderer/src/components/terminal-pane/agent-completion/agent-completion-coordinator-process-cadence.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-completion-and-notification.test.ts\",\"src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\",\"src/shared/claimed-agent-pty-owner.test.ts\",\"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\"src/main/runtime/session-construction/agent-session/orca-runtime-agent-session-operation.test.ts\",\"src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts\",\"src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"tests/e2e/remote-agent-session-focus-authority.spec.ts\",\"config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs\",\"tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts\",\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts\",\"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\"]",
        "Complete prior assertionRefs before exact deleted selectors were pruned: [{\"file\":\"src/main/daemon/providers/routing/testing/degraded-daemon-pty-provider.test.ts\",\"assertions\":[\"completion inspection rejects an unmapped session instead of borrowing the local fallback\"]},{\"file\":\"tests/e2e/remote-agent-completion-authority.unit.test.ts\",\"assertions\":[\"transport loss remains unknown through reconnect and cannot dispatch completion\",\"returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples\",\"explicit stop, real exit status, and genuine successful completion remain distinct\"]},{\"file\":\"src/renderer/src/lib/agent-session/accounts/codex/codex-session-restart.test.ts\",\"assertions\":[\"one unreachable pane cannot suppress restart notices for another authoritatively confirmed Codex pane\"]},{\"file\":\"src/shared/claimed-agent-pty-owner.test.ts\",\"assertions\":[\"concurrent exact claims spawn once and later callers adopt the canonical owner\",\"same identity in another worktree conflicts and cannot be found as the current scope's owner\",\"generation-guarded exit and authoritative reconciliation cannot retire a replacement owner\"]},{\"file\":\"src/main/runtime/session-construction/agent-session/remote-agent-session-host-authority.integration.test.ts\",\"assertions\":[\"independent runtime clients converge on one canonical live agent-session owner\",\"retries and concurrent requests cannot create a second physical PTY\"]},{\"file\":\"src/main/runtime/terminal/surface/orca-runtime-terminal-retirement.test.ts\",\"assertions\":[\"an exact PTY exit retires host membership and stale topology cannot recreate the surface\",\"incarnation fencing prevents an old delayed exit from retiring a replacement PTY\"]},{\"file\":\"tests/e2e/remote-agent-session-focus-authority.spec.ts\",\"assertions\":[\"headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus\",\"legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor\",\"host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup\"]},{\"file\":\"config/scripts/diagnostics/remote-agent-authority/remote-agent-session-authority-repro.mjs\",\"assertions\":[\"headless focused fresh/resume requests create background host surfaces without a renderer window\",\"dropped committed responses replay the same operation identity without another tokened agent spawn\",\"exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup\"]},{\"file\":\"config/scripts/development/remote-session-cleanup/remote-agent-session-process-cleanup.mjs\",\"assertions\":[\"isolated daemon roots and captured descendants are verified dead before profile PID records are removed\"]},{\"file\":\"tests/e2e/remote-terminal-tab-retirement.unit.test.ts\",\"assertions\":[\"a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom\",\"one exact exit produces one same-epoch higher-version host publication and one durable persistence flush\",\"same-epoch stale publications cannot resurrect the retired surface after reconnect\"]},{\"file\":\"src/renderer/src/runtime/web-session-tabs-sync/navigation/web-session-tabs-sync-focus-intent.test.ts\",\"assertions\":[\"replays a snapshot that beat the RPC response and focuses the exact adopted leaf\",\"retains exact-leaf focus intent when a split sibling publishes first\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts\",\"assertions\":[\"mirrors a new CLI tab after old-host recovery when $name\"]},{\"file\":\"src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts\",\"assertions\":[\"serializes a newer convergence snapshot after an in-flight adoption conflict\"]}]"
      ],
      "demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if a retry can physically spawn twice, if a stale exit/publication can replace or resurrect a terminal, or if mixed-version fallback occurs after an authority side effect."
    },
    {
      "id": "runtime-routing.active-server-preference",
      "title": "Active Server changes only through its explicit Advanced control",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-routing",
      "layer": "main-preload-renderer-persistence-contract",
      "surfaces": [
        "Advanced Active Server setting",
        "saved server Connect and Disconnect",
        "remote workspace navigation",
        "Add Project host selection, scan, import, and catalog refresh",
        "terminal reveal and create",
        "browser and mobile handoff",
        "app restart"
      ],
      "platforms": ["macos", "linux", "windows", "mobile"],
      "providers": ["local", "remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": [],
      "coverageNotes": "Audit3362 retires the whole settings suite, including dirty-draft focus, background-host keepalive, protocol/catalog compatibility, stale/failure and refresh examples. The compound unit selector and test-file entry narrow; all prior owner-routing retirements/history remain. Four unrelated selected-runtime macOS E2E receipts remain verbatim and do not validate the changed unit selector. No equivalent replacement or fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3349 retires the explicit runtime-owner, explicit SSH-owner and missing-owner-after-catalog-change examples from worktrees-fetch-owner-routing. Of those four named assertions, only the missing-owner-after-provider-reconnect assertion remains; the command and test-file selector survive. Those three alarms are intentionally lost without equivalent replacement. Four unrelated physical selected-runtime macOS E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh runtime, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: drops older same-host group and folder responses that finish last — Copies group and folder fixtures plus four deferred responses to re-test the same generic catalog generation fence in two wrappers. Retires stale same-host response rejection at these API copies.; drops pre-reconnect group and folder responses without pruning the new catalog — Directly replaces pairing/catalog fixtures then resolves scripted old group/folder replies; repeats identity-fence contract in two catalog wrappers without real reconnect. Retires pre-reconnect catalog pruning refusal example.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit2371 reduces all-host-folder-workspace-catalogs.test.ts by removing the repeated offline compatibility-probe budget and its incidental local-fallback/restored-owner samples, and catalog-settlement-notifications.test.ts by removing the four-route ten-equal-refresh notification/reference matrix. Those probe, quietness, identity and fallback alarms are intentionally lost. Remaining stale-response and revision-fencing examples do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced sources; the four unrelated physical selected-runtime E2E receipts retain their original commands and scope. Historical prior account (preserved verbatim): Audit2360 removes src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts and its exclusive fake-effect harness. Lose local default-runtime persistence across navigation; focused/background terminal request/create/reveal and no-focus recovery; startup cwd/config/agent/view-mode forwarding; explicit runtime-session routing; remote/ambiguous/missing owner refusal; history focus; existing PTY reuse/title preservation; pending tab PTY/layout/identity adoption; split tree, focus, identity and telemetry samples. No equivalent replacement claimed. Changed selectors have no fresh execution or red/green credit. Unrelated retained receipt objects keep their original narrow scope. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/store/project-groups/nested-repository-operations.test.ts: routes local nested scan progress by scanId and unsubscribes after completion. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1488 deletes NonGitFolderDialog tests. The hand-assembled scan/import pipelines, supplied host and folder outcomes, registration callback receipts and static host confirmation alarms are retired. No equivalent replacement coverage or fresh routing validation is claimed. Historical receipts and assertions describe their original sources only. Audit1487 deletes AddProjectFromFolderDialog and project-added-default-checkout tests and reduces AddRepoStartSteps to custom ArrowDown navigation. Mocked admission/activation and static host-control assertions are retired. No equivalent replacement coverage or fresh routing validation is claimed. Historical receipts and assertions below describe their original sources only. Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/store/slices/repos-stale-fetch.spec.ts: Loses startup catalog admission/reconnect preservation and settlement failure gating alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1391 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1342 and1337 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes browser generic Active Server settings isolation and unknown-choice examples; their direct preference and rejection alarms are lost. Other routing evidence is not an equivalent replacement. Historical commands and results remain historical. Platform-neutral deterministic tests separate the durable Active Server preference from per-client connection, selected-workspace, browser-session, Add Project, and execution-host routing. The composed regression models Local desktop -> connect/navigate Windows 2 -> reveal a local terminal -> restart. Multi-client browser host overrides, multi-server profile caches, generic settings IPC rejection, local and remote workspace ownership, Add Project eligibility/owner capture/stale-result fencing, host-qualified group/folder/worktree identity, and restart reset of transient routing are covered. A visible macOS Orca desktop server plus separate paired Electron and web clients prove selected-runtime Add Project operations and disabled creation when the only listed host is blocked or unavailable; headless-server parity also passed. Live Linux, Windows, WSL, and SSH Add Project journeys remain uncollected. The static wrapper-rendering suite was removed during the low-value-test audit; its supplied-prop host-browser and control-visibility output assertions are no longer checked by that suite. This removal supplies no new runtime-routing evidence. The fake-React Clone hook unit suite was also retired: its captured-owner and same-ID sibling assertions no longer supply unit evidence. Historical run commands and counts remain historical; this retirement adds no runtime-routing, cross-platform, or mobile evidence. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit narrowed worktree-runtime-owner.test.ts to deterministic owner-lookup work bounds with correct worktree/folder results and changed-collection invalidation. Its separate host/default/folder/mirror inventory alarms are lost; these retained in-memory checks establish no actual host delivery, restart or equivalent replacement coverage. Historical run commands and results remain historical. web-runtime-session.test.ts no longer supplies the terminal/browser/staged-browser explicit-host collision assertions formerly referenced here. Those direct routing alarms are lost; the remaining selector and live routing evidence does not establish equivalent replacement coverage. The test-value audit removes the direct host/provider/project-setup selector tables. selectors.test.ts retains only floating-tab/unread scan-cost checks, which supply no current Active Server routing evidence. Its separate missing-runtime/no-local-fallback and owner-choice alarms are lost; other gate evidence is not an equivalent replacement. Historical executed commands and results remain historical. browser.test.ts no longer supplies the host/profile projection examples. Current routing commands and references name the retained deferred host-list/import completion tests in browser-session-host-selection.test.ts instead. Its actual source supports stale-completion fencing; it does not establish the formerly listed multi-client selection or restart-reset claims. Other evidence is not an equivalent replacement; historical executed commands/counts/results remain historical. The test-value audit deletes repos-paired-runtime-add.test.ts. Its supplied-result assertion that an explicitly selected paired host receives repo.add with the selected path, folder kind and 15000ms timeout while native repos.add and pickFolder remain unused is intentionally lost. Other gate evidence is not an equivalent replacement. Historical executed commands, counts and results remain unchanged. The test-value audit narrows repos-selected-owner-routing.test.ts to an overlapping selected-runtime import/local refresh, reversed same-host folder replies, and group/folder replies crossing an actual pairing revision. Its separate same-ID host-partition, desktop-only pruning, sequential explicit-runtime preservation, and SSH scan/cancel forwarding alarms are intentionally lost. The stale-response case overwrites its group result before the final assertion, so it supplies only a folder stale-response alarm. The catalog-reconciliation caller also retires the refresh-identity and runtime-visibility-default registrars: their immediate reference/field/count, filter/dismissal, readoption-inventory, timestamp and settings/capability-copy/retention alarms are lost. No equivalent replacement or new live host, restart, platform or mobile evidence is claimed; historical executed commands, counts and results remain unchanged. The test-value audit removes the reversed-order direct worktree lookup example from selected-host-active-workspace-identity.test.ts. Its explicit-runtime path lookup with reversed same-ID catalog rows is intentionally lost; that example did not activate a workspace. After the subsequent audit, current assertions in this suite name only the retained local-first worktree activation; the selected-runtime folder/group host-echo example was removed. They are not equivalent replacements for the reversed-order lookup alarm. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed. The test-value audit narrows renderer store settings.test.ts by removing immediate authoritative-settings/response rebasing, checked-failure forwarding, best-effort logging, mobile-address/provider normalization, successful catalog-start, hand-seeded partial-status coverage and ghost-status filtering examples. Those direct response, normalization, error and catalog-projection alarms are intentionally lost. The runtime focus-switch resource/draft preservation, unreachable/incompatible refusal and held catalog coalescing/retry/staleness cases remain; they are not equivalent replacements for the removed alarms. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed. The test-value audit narrows worktrees-fetch-owner-routing.test.ts by removing default-local transport selection, ownerless runtime stamping, isolated force-local routing, and mocked mobile-denial/toast examples. Those direct routing, field and presentation alarms are lost. Retained concurrency and authority-fencing cases do not establish equivalent replacement coverage or live host, platform, restart or mobile evidence. Historical commands, counts and results remain unchanged. The test-value audit removes the separate paired-web host-switch resource-preservation example from renderer store settings.test.ts. Its explicit web-mode terminal/browser no-close and retained PTY/remote-browser-handle alarms are intentionally lost. The surviving desktop host-merge, resource/draft preservation, refusal and catalog retry/coalescing/staleness cases are not equivalent replacement coverage. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed. The test-value audit removes the selected-runtime folder/group activation example from selected-host-active-workspace-identity.test.ts. That large same-ID fixture only asserted that the explicit host argument was stored and read back; it did not check the chosen folder path, group or delivered operation. Its narrow non-rejection/host-echo alarm is intentionally lost. Only the local-first worktree case that independently checks the returned runtime path remains in this suite. Historical executed commands, counts and results remain unchanged; no equivalent replacement or new live-host evidence is claimed. The continued test-value audit narrows worktrees-fetch-owner-routing.test.ts by retiring the simple explicit-local duplicate-repo request and runtime-only host-stamping examples. Those exact request-option and supplied-row alarms are intentionally lost. The retained force-local sibling-preservation and project-setup stamping cases use different inputs and are not equivalent replacements. Historical commands, counts and results remain unchanged; no live-host, restart, platform or mobile evidence is added. The test-value audit removes the browser-settings host-option fallback helper suite. Its direct selected/default/empty-option preference alarms are lost; no browser session, host delivery or persistence was exercised there. Remaining routing evidence is not an equivalent replacement. Historical commands, counts and results remain historical. The test-value audit deletes paired-web-add-project-unavailable-host.spec.ts. Its injected blocked/unavailable-host disabled-action and no-local-option presentation alarms are intentionally lost. The snapshot sequence and null transport do not prove actual version negotiation or operation rejection. Other routing evidence is not an equivalent replacement; no new runtime, platform or mobile evidence is claimed. The two retired historical receipts and assertion reference are archived below with their original fields and results. Audit1320: src/renderer/src/components/settings/runtime-environments/catalog/RuntimeEnvironmentsPane.test.ts removed. Transport-up/runtime-down, failed-probe ready/reconnect/handshake and stale compatibility label/button state inventories lose alarms. No equivalent replacement coverage is claimed. Audit1342: src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts removed. Runtime/SSH/default row ownership and folder/project path-status routing samples disappear. src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1337: src/renderer/src/components/sidebar/project-admission/dialog/add-repo-browse-authority.test.ts removed. Removes paired-host browse versus native picker callback flags and SSH no-browse predicate samples. src/renderer/src/components/sidebar/project-admission/dialog/AddRepoDialog.default-checkout.test.ts removed. Removes explicit local/runtime versus missing owner selector examples. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1391: src/renderer/src/lib/worktree-runtime-owner.test.ts reduced. Lose explicit repeated-lookup work/read budget and standalone initial owner lookup alarms. Retained production resolver proves changed ownership is visible, using synthetic catalogs rather than server publication. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/9687",
        "https://linear.app/stably/issue/STA-4024/p1-paired-web-add-project-enables-unavailable-host-fallback-after-pr"
      ],
      "invariant": "Only an explicit user change in Settings > Remote Orca Servers > Advanced > Active Server may mutate activeRuntimeEnvironmentId. Connecting, pairing, disconnecting, selecting or revealing a workspace or terminal, browser/mobile handoff, remote navigation, and reconnect must use transient or target-owner routing and must never rewrite the durable preference. Every Add Project selected host must satisfy canSelectAddRepoHost; paired web has no local filesystem fallback, so no valid host means Browse, Clone, and Create remain disabled. Every operation stays on the host selected when it began, even if preference or catalog state changes. Generic settings mutation cannot bypass the dedicated preference IPC.",
      "oracle": "Audit3362 retires the whole settings suite, including dirty-draft focus, background-host keepalive, protocol/catalog compatibility, stale/failure and refresh examples. The compound unit selector and test-file entry narrow; all prior owner-routing retirements/history remain. Four unrelated selected-runtime macOS E2E receipts remain verbatim and do not validate the changed unit selector. No equivalent replacement or fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3349 retires the explicit runtime-owner, explicit SSH-owner and missing-owner-after-catalog-change examples from worktrees-fetch-owner-routing. Of those four named assertions, only the missing-owner-after-provider-reconnect assertion remains; the command and test-file selector survive. Those three alarms are intentionally lost without equivalent replacement. Four unrelated physical selected-runtime macOS E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh runtime, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: drops older same-host group and folder responses that finish last — Copies group and folder fixtures plus four deferred responses to re-test the same generic catalog generation fence in two wrappers. Retires stale same-host response rejection at these API copies.; drops pre-reconnect group and folder responses without pruning the new catalog — Directly replaces pairing/catalog fixtures then resolves scripted old group/folder replies; repeats identity-fence contract in two catalog wrappers without real reconnect. Retires pre-reconnect catalog pruning refusal example.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit2371 reduces all-host-folder-workspace-catalogs.test.ts by removing the repeated offline compatibility-probe budget and its incidental local-fallback/restored-owner samples, and catalog-settlement-notifications.test.ts by removing the four-route ten-equal-refresh notification/reference matrix. Those probe, quietness, identity and fallback alarms are intentionally lost. Remaining stale-response and revision-fencing examples do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced sources; the four unrelated physical selected-runtime E2E receipts retain their original commands and scope. Historical prior account (preserved verbatim): Audit2360 removes src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts and its exclusive fake-effect harness. Lose local default-runtime persistence across navigation; focused/background terminal request/create/reveal and no-focus recovery; startup cwd/config/agent/view-mode forwarding; explicit runtime-session routing; remote/ambiguous/missing owner refusal; history focus; existing PTY reuse/title preservation; pending tab PTY/layout/identity adoption; split tree, focus, identity and telemetry samples. No equivalent replacement claimed. Changed selectors have no fresh execution or red/green credit. Unrelated retained receipt objects keep their original narrow scope. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/store/project-groups/nested-repository-operations.test.ts: routes local nested scan progress by scanId and unsubscribes after completion. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Start with Active Server=Local desktop, connect and navigate Windows 2, then reveal a local terminal and assert it succeeds while the persisted preference remains local before and after restart. Repeat transient routing and selected-runtime Add Project operations with exact-ID host decoys and completion reordering. Separately pair the real web client to an isolated headed host, then make its sole still-listed runtime compatibility-blocked and unavailable. Require a null authoritative selection, a disabled host option, and disabled Browse, Clone, and Create actions with no local fallback. Repeat against headless serve. Run the byte-identical selector/action contract on latest main, candidate, and candidate with the eligibility seam disabled.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts src/renderer/src/store/slices/browser/hosts/browser-session-host-selection.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/repos/ssh-repo-readoption-drafts.test.ts src/renderer/src/store/folder-workspaces/folder-workspace-readoption-drafts.test.ts src/renderer/src/store/repos/repo-catalog-readoption-drafts.test.ts src/renderer/src/store/folder-workspaces/all-host-folder-workspace-catalogs.test.ts src/renderer/src/store/host-catalog/catalog-settlement-notifications.test.ts src/renderer/src/store/repos/repos-stale-fetch.test.ts src/renderer/src/store/folder-workspaces/folder-workspace-routing.test.ts src/renderer/src/store/repos/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/worktrees/session/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees/listing/worktrees-fetch-owner-routing.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx --maxWorkers=1",
        "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
        "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
      ],
      "testFiles": [
        "src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
        "src/renderer/src/store/slices/browser/hosts/browser-session-host-selection.test.ts",
        "src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
        "src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx",
        "src/renderer/src/store/repos/ssh-repo-readoption-drafts.test.ts",
        "src/renderer/src/store/folder-workspaces/folder-workspace-readoption-drafts.test.ts",
        "src/renderer/src/store/repos/repo-catalog-readoption-drafts.test.ts",
        "src/renderer/src/store/folder-workspaces/all-host-folder-workspace-catalogs.test.ts",
        "src/renderer/src/store/host-catalog/catalog-settlement-notifications.test.ts",
        "src/renderer/src/store/repos/repos-stale-fetch.test.ts",
        "src/renderer/src/store/folder-workspaces/folder-workspace-routing.test.ts",
        "src/renderer/src/store/repos/repos-selected-owner-routing.test.ts",
        "src/renderer/src/store/slices/worktrees/session/selected-host-active-workspace-identity.test.ts",
        "src/renderer/src/store/slices/worktrees/listing/worktrees-fetch-owner-routing.test.ts",
        "tests/e2e/pr11346-selected-runtime-add.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/store/slices/browser/hosts/browser-session-host-selection.test.ts",
          "assertions": [
            "a slower host profile response cannot overwrite the newly selected host",
            "an import completion cannot refresh or overwrite a newly selected host"
          ]
        },
        {
          "file": "src/renderer/src/store/repos/repos-selected-owner-routing.test.ts",
          "assertions": [
            "keeps a selected-runtime import refresh across an overlapping local refresh"
          ]
        },
        {
          "file": "src/renderer/src/store/slices/worktrees/listing/worktrees-fetch-owner-routing.test.ts",
          "assertions": ["rejects a missing-owner SSH result after the provider reconnects"]
        },
        {
          "file": "src/renderer/src/store/slices/worktrees/session/selected-host-active-workspace-identity.test.ts",
          "assertions": [
            "selects and activates the runtime worktree when exact repo/worktree IDs collide in local-first order",
            "keeps exact-ID folder/group activation on the explicitly selected runtime without local fallback"
          ]
        },
        {
          "file": "tests/e2e/pr11346-selected-runtime-add.spec.ts",
          "assertions": [
            "routes Git Add, plain-folder Add, Clone, Create, and nested import to a selected non-default headed runtime while exact-ID local siblings remain visible and cannot capture final activation @headful",
            "preserves same-ID runtime group/folder/worktree catalogs across reversed order, local refresh, switch, disconnect, and reconnect-overlap completion",
            "keeps every expanded selected-runtime Add Project path in hidden-window desktop parity",
            "creates the first paired runtime terminal while same-ID local/runtime worktrees remain visible without clearing the selected runtime owner"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-30",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 23,
          "summary": "A visible isolated Orca desktop server and separate paired Electron client added one real Git repo, one plain folder, one clone, one created project, and two nested repos to the selected non-default runtime across preference switches and disconnect/reconnect. Exact-ID local/runtime repo, worktree, group, and folder rows remained concurrently visible in local-first and reversed order without capturing final activation. Server inventory, active host identity, rendered rows, local-client exclusion, preserved post-reconnect catalogs, and zero direct SSH fallback agreed. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 307/1667/2932/1247/1321/259/1319 ms.",
          "currentCommand": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line"
        },
        {
          "date": "2026-07-30",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 66,
          "summary": "The hidden-window desktop-server parity journey passed with exact-ID Add/Clone/Create activation, selected-runtime inventory, reversed catalog order, reconnect overlap, ownership, local exclusion, and host-qualified catalog-preservation assertions. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 59/1770/4330/1375/2137/279/1945 ms.",
          "currentCommand": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        },
        {
          "date": "2026-07-31",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 19.9,
          "summary": "The visible headed server and separate paired client passed the strengthened same-ID terminal-activation oracle with a disposable runtime Git identity. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 43/1513/3841/1200/790/202/1312 ms.",
          "currentCommand": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line"
        },
        {
          "date": "2026-07-31",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
          "result": "passed",
          "durationSeconds": 19.7,
          "summary": "The hidden-window server and separate paired client passed the strengthened same-ID terminal-activation oracle with a disposable runtime Git identity. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 51/1502/3843/880/939/200/1359 ms.",
          "currentCommand": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1391; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audits1342 and1337; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1320; any retained unchanged-source receipts apply only to their own commands. Historical account: Deterministic contracts and the final visible plus hidden-window paired Electron runs passed locally. During expansion, attempts exposed three harness-only assumptions: exact project labels did not allow path disambiguation, clicking the inner host label raced cmdk layout, and a disposable CI runtime had no Git author identity for Create. The oracle now targets the host command item, accepts the rendered disambiguated label, seeds only its isolated runtime home with a test Git identity, and explicitly creates a first paired terminal while same-ID local/runtime worktrees remain present. CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1391 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audits1342 and1337 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1320 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The Add Project selector file from fix-disabled overlay 17a612c819 and candidate 8abf0f5d20 is byte-identical (SHA-256 f34c3c69c8adba23811c3a3b6a0efb669f787666c5ada086df8a167e785eea20): its blocked and unavailable sole-host cases fail with the production fix disabled on latest main ebe5125476 after PR #13909 and pass on the candidate. The focused combined selector/transaction invocation was 3 failed with 69 skipped on the red overlay and 3 passed with 75 skipped on the candidate; the different totals come from supplemental browser-transaction cases, not this selector file. The originating/latest affected main 1136503c6a and its fix-disabled overlay were also red before the provider-gating rebase. The byte-identical focused oracle (SHA-256 6de18c140a86801460e58f52287e27a58b97f1576f9f387fa82e1bd4eb378f7b) fails 2/3 on review baseline aa6f945001a5f78a07663c854fabb95c55d8b40b and on the r5-disabled parent e21f4ca58e: local-first lookup returns /local/repo and folder activation has no runtime host. It passes 3/3 on the candidate. Main later advanced to 94cf2f1422f30fc309cb47c5e864a831d516fa8b without changing any of the candidate's 68 files or the focused oracle production boundary; the rebased disabled parent f247d961cab15237bc7fcf0598fe76007f78ec7c has the same stable patch ID as e21f4ca58e. The final paired spec and fixture have SHA-256 bd6d9014d1bed2715397bcd2121d5d7e01792347b13ff14778ccf608bf98789c and d1d78a82f868e2f3152777550825c0ca2d4dc3cba5c6de548e066d2931751fc7. With the final runtime-session owner fix disabled, the focused session test fails 3/43 and the byte-identical hidden paired oracle deterministically creates the host terminal but reports null active client owner while same-ID local/runtime worktrees remain. The integrated candidate passes the same focused test and both headed/hidden paired oracles with exact runtime ownership, server inventory, local exclusion, preserved catalogs, visible rows, and zero direct SSH fallback. Earlier Active Server preference paths retain deterministic coverage but do not yet have a saved intentional-break artifact."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Preference writes are explicit user actions; transient routing adds no polling or provider fanout and retains one authoritative worktree refresh per completed add. Host-qualified owner indexes are WeakMap-cached and do not add subprocesses or network calls. The final headed journey measured 43 ms for three preference switches, 1,513 ms for Git add, 3,841 ms for folder add, 1,200 ms for Clone, 790 ms for Create with controlled exact-ID completion gates, 202 ms for disconnect/reconnect with overlapping catalog refreshes, and 1,312 ms for nested import. The final session-activation fix adds one execution-host string conversion per explicit terminal/browser activation and no provider call, scan, timer, or retry. Existing Zustand selector fan-out evidence remained 0 render invalidations across 5,000,000 selector runs."
      },
      "promotionCriteria": [
        "Run the focused gate in soak across macOS, Linux, and Windows.",
        "Attach a live Windows Local -> Windows 2 -> local reveal -> restart artifact.",
        "Attach saved red/green evidence for generic settings mutation and transient connection routing.",
        "Run the paired Add Project journey on Linux and native Windows, plus live SSH and WSL hosts."
      ],
      "knownGaps": [
        "Audit2680: Delete the whole supplied-state worktree-runtime-owner suite. Lose immutable collection-reference invalidation and per-worktree override/folder inheritance lookup alarms without replacement. Remove its prospective selector and file membership; unchanged independent Electron evidenceRuns remain historical and do not validate the reduced selector. No fresh execution or equivalent replacement is claimed.",
        "Audit2680 historical original selector metadata, preserved verbatim; not current evidence: {\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/workspace/ownership/worktree-runtime-owner.test.ts src/renderer/src/store/repos/ssh-repo-readoption-drafts.test.ts src/renderer/src/store/folder-workspaces/folder-workspace-readoption-drafts.test.ts src/renderer/src/store/repos/repo-catalog-readoption-drafts.test.ts src/renderer/src/store/folder-workspaces/all-host-folder-workspace-catalogs.test.ts src/renderer/src/store/host-catalog/catalog-settlement-notifications.test.ts src/renderer/src/store/repos/repos-stale-fetch.test.ts src/renderer/src/store/folder-workspaces/folder-workspace-routing.test.ts src/renderer/src/store/repos/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/worktrees/session/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees/listing/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\",\"testFiles\":\"src/renderer/src/lib/workspace/ownership/worktree-runtime-owner.test.ts\"}",
        "Audit2360 removes src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts and its exclusive fake-effect harness. Lose local default-runtime persistence across navigation; focused/background terminal request/create/reveal and no-focus recovery; startup cwd/config/agent/view-mode forwarding; explicit runtime-session routing; remote/ambiguous/missing owner refusal; history focus; existing PTY reuse/title preservation; pending tab PTY/layout/identity adoption; split tree, focus, identity and telemetry samples. No equivalent replacement claimed. Changed selectors have no fresh execution or red/green credit. Unrelated retained receipt objects keep their original narrow scope. Retired assertion reference verbatim: {\n          \"file\": \"src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts\",\n          \"assertions\": [\n            \"Local desktop remains the durable default after transient Windows 2 navigation and a focused local terminal reveal succeeds\",\n            \"local and remote terminal create route by target workspace ownership instead of the durable preference\"\n          ]\n        }",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The exact journey is deterministic contract coverage, not a packaged Windows UI automation run.",
        "Browser/mobile handoff is covered through transient routing state and preload contracts, not a live phone browser session.",
        "The paired Add Project journey is macOS-only; native Windows was unavailable.",
        "SSH and WSL Add Project ownership is deterministic store/controller coverage, not a live host journey.",
        "The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical.",
        "web-runtime-session.test.ts no longer supplies the terminal/browser/staged-browser explicit-host collision assertions formerly referenced here. Those direct routing alarms are lost; the remaining selector and live routing evidence does not establish equivalent replacement coverage.",
        "The test-value audit removes the direct host/provider/project-setup selector tables. selectors.test.ts retains only floating-tab/unread scan-cost checks, which supply no current Active Server routing evidence. Its separate missing-runtime/no-local-fallback and owner-choice alarms are lost; other gate evidence is not an equivalent replacement. Historical executed commands and results remain historical.",
        "browser.test.ts no longer supplies the host/profile projection examples. Current routing commands and references name the retained deferred host-list/import completion tests in browser-session-host-selection.test.ts instead. Its actual source supports stale-completion fencing; it does not establish the formerly listed multi-client selection or restart-reset claims. Other evidence is not an equivalent replacement; historical executed commands/counts/results remain historical.",
        "The test-value audit deletes repos-paired-runtime-add.test.ts. Its supplied-result assertion that an explicitly selected paired host receives repo.add with the selected path, folder kind and 15000ms timeout while native repos.add and pickFolder remain unused is intentionally lost. Other gate evidence is not an equivalent replacement. Historical executed commands, counts and results remain unchanged.",
        "The test-value audit narrows repos-selected-owner-routing.test.ts to an overlapping selected-runtime import/local refresh, reversed same-host folder replies, and group/folder replies crossing an actual pairing revision. Its separate same-ID host-partition, desktop-only pruning, sequential explicit-runtime preservation, and SSH scan/cancel forwarding alarms are intentionally lost. The stale-response case overwrites its group result before the final assertion, so it supplies only a folder stale-response alarm. The catalog-reconciliation caller also retires the refresh-identity and runtime-visibility-default registrars: their immediate reference/field/count, filter/dismissal, readoption-inventory, timestamp and settings/capability-copy/retention alarms are lost. No equivalent replacement or new live host, restart, platform or mobile evidence is claimed; historical executed commands, counts and results remain unchanged.",
        "The test-value audit removes the reversed-order direct worktree lookup example from selected-host-active-workspace-identity.test.ts. Its explicit-runtime path lookup with reversed same-ID catalog rows is intentionally lost; that example did not activate a workspace. Current assertions name the retained local-first worktree activation and selected-runtime folder/group activation only. They are not equivalent replacements for the reversed-order lookup alarm. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed.",
        "The test-value audit narrows renderer store settings.test.ts by removing immediate authoritative-settings/response rebasing, checked-failure forwarding, best-effort logging, mobile-address/provider normalization, successful catalog-start, hand-seeded partial-status coverage and ghost-status filtering examples. Those direct response, normalization, error and catalog-projection alarms are intentionally lost. The runtime focus-switch resource/draft preservation, unreachable/incompatible refusal and held catalog coalescing/retry/staleness cases remain; they are not equivalent replacements for the removed alarms. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed.",
        "The test-value audit narrows worktrees-fetch-owner-routing.test.ts by removing default-local transport selection, ownerless runtime stamping, isolated force-local routing, and mocked mobile-denial/toast examples. Those direct routing, field and presentation alarms are lost. Retained concurrency and authority-fencing cases do not establish equivalent replacement coverage or live host, platform, restart or mobile evidence. Historical commands, counts and results remain unchanged.",
        "The test-value audit removes the separate paired-web host-switch resource-preservation example from renderer store settings.test.ts. Its explicit web-mode terminal/browser no-close and retained PTY/remote-browser-handle alarms are intentionally lost. The surviving desktop host-merge, resource/draft preservation, refusal and catalog retry/coalescing/staleness cases are not equivalent replacement coverage. Historical executed commands, counts and results remain unchanged; no new live host, restart, platform or mobile evidence is claimed.",
        "The test-value audit removes the selected-runtime folder/group activation example from selected-host-active-workspace-identity.test.ts. That large same-ID fixture only asserted that the explicit host argument was stored and read back; it did not check the chosen folder path, group or delivered operation. Its narrow non-rejection/host-echo alarm is intentionally lost. Only the local-first worktree case that independently checks the returned runtime path remains in this suite. Historical executed commands, counts and results remain unchanged; no equivalent replacement or new live-host evidence is claimed.",
        "The continued test-value audit narrows worktrees-fetch-owner-routing.test.ts by retiring the simple explicit-local duplicate-repo request and runtime-only host-stamping examples. Those exact request-option and supplied-row alarms are intentionally lost. The retained force-local sibling-preservation and project-setup stamping cases use different inputs and are not equivalent replacements. Historical commands, counts and results remain unchanged; no live-host, restart, platform or mobile evidence is added.",
        "The test-value audit removes the browser-settings host-option fallback helper suite. Its direct selected/default/empty-option preference alarms are lost; no browser session, host delivery or persistence was exercised there. Remaining routing evidence is not an equivalent replacement. Historical commands, counts and results remain historical.",
        "The test-value audit deletes paired-web-add-project-unavailable-host.spec.ts. Its injected blocked/unavailable-host disabled-action and no-local-option presentation alarms are intentionally lost. The snapshot sequence and null transport do not prove actual version negotiation or operation rejection. Other routing evidence is not an equivalent replacement; no new runtime, platform or mobile evidence is claimed. The two retired historical receipts and assertion reference are archived below with their original fields and results.",
        "Archived retired-suite historical data (JSON): {\"assertionRefs\":[{\"file\":\"tests/e2e/paired-web-add-project-unavailable-host.spec.ts\",\"assertions\":[\"a version-blocked sole host stays visible and non-selectable while Browse, Clone, and Create are disabled\",\"an unavailable sole host has the same disabled action contract without a local fallback\",\"the rendered contract passes against headed desktop and headless serve hosts\"]}],\"evidenceRuns\":[{\"date\":\"2026-08-12\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line\",\"result\":\"passed\",\"durationSeconds\":12.3,\"summary\":\"A real paired web client against a visible desktop host kept the sole blocked and unavailable runtime listed but non-selectable, with Browse, Clone, and Create disabled and no local host fallback.\",\"currentCommand\":\"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line\"},{\"date\":\"2026-08-12\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\",\"result\":\"passed\",\"durationSeconds\":5.8,\"summary\":\"The same present-but-blocked and present-but-unavailable Add Project action oracle passed against isolated headless serve.\",\"currentCommand\":\"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line\"}]}",
        "Audit1320: src/renderer/src/components/settings/runtime-environments/catalog/RuntimeEnvironmentsPane.test.ts removed. Transport-up/runtime-down, failed-probe ready/reconnect/handshake and stale compatibility label/button state inventories lose alarms. No equivalent replacement coverage is claimed.",
        "Audit1320 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser-session-host-selection.test.ts src/renderer/src/components/settings/runtime-environments/catalog/RuntimeEnvironmentsPane.test.ts src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.55,\n          \"summary\": \"Ten files and 282 tests passed, including the composed Local -> Windows 2 navigation -> local reveal -> restart regression, dedicated-only preference persistence, removed transient-host fallback, multi-client browser routing, late host-operation suppression, and web pairing/preference separation.\"\n        }",
        "Audit1320 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/settings/runtime-environments/catalog/RuntimeEnvironmentsPane.test.ts\",\n    \"assertions\": [\n      \"connection status and the Advanced default-host selection are distinct concepts\"\n    ]\n  }\n]",
        "Audit1342: src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts removed. Runtime/SSH/default row ownership and folder/project path-status routing samples disappear. src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.77,\n          \"summary\": \"Nineteen files and 386 tests passed after rebasing onto 94cf2f1422f30fc309cb47c5e864a831d516fa8b, including exact-ID repo/worktree/group/folder host identity in both catalog orders, fail-closed active-repo selection when a runtime row is unavailable, selected runtime and SSH owner capture through final Add/Clone/Create/folder activation, direct-SSH authoritative pruning, reversed catalog responses, reconnect generation fencing, local-after-runtime isolation, and missing-catalog worktree routing.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-31\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts src/renderer/src/runtime/web-runtime-session.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.1,\n          \"summary\": \"Twenty files and 430 tests passed on current main integration, including explicit runtime-owner preservation for terminal and browser session activation.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"remote-runtime\",\"ssh\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1337: src/renderer/src/components/sidebar/project-admission/dialog/add-repo-browse-authority.test.ts removed. Removes paired-host browse versus native picker callback flags and SSH no-browse predicate samples. src/renderer/src/components/sidebar/project-admission/dialog/AddRepoDialog.default-checkout.test.ts removed. Removes explicit local/runtime versus missing owner selector examples. No equivalent replacement coverage is claimed.",
        "Audit1337 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"remote-runtime\",\"ssh\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1337 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/sidebar/project-admission/dialog/add-repo-browse-authority.test.ts\",\n    \"assertions\": [\n      \"paired runtime browsing opens the host browser without invoking native pickFolders while desktop local and SSH routes remain intact\"\n    ]\n  }\n]",
        "Audit1391: src/renderer/src/lib/worktree-runtime-owner.test.ts reduced. Lose explicit repeated-lookup work/read budget and standalone initial owner lookup alarms. Retained production resolver proves changed ownership is visible, using synthetic catalogs rather than server publication. No equivalent replacement coverage is claimed.",
        "Audit1391 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\",\n          \"durationSeconds\": 11.12,\n          \"summary\": \"Test Files  10 passed (10); Tests  83 passed (83). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit1391 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/dialog/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/slices/repos-catalog-reconciliation.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1\",\n          \"durationSeconds\": 10.15,\n          \"summary\": \"Test Files  10 passed (10); Tests  83 passed (83). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit1391 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local\",\"remote-runtime\",\"ssh\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1417 intentionally reduces src/renderer/src/store/slices/repos-stale-fetch.spec.ts: Loses startup catalog admission/reconnect preservation and settlement failure gating alarms. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1487 deletes AddProjectFromFolderDialog and project-added-default-checkout tests and reduces AddRepoStartSteps to custom ArrowDown navigation. Mocked admission/activation and static host-control assertions are retired. No equivalent replacement coverage or fresh routing validation is claimed. Historical receipts and assertions below describe their original sources only.",
        "Audit1487 retires this complete dated receipt because its source changed; not current execution evidence: {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx --maxWorkers=1\",\"durationSeconds\":3.99,\"summary\":\"Test Files  1 passed (1); Tests  14 passed (14). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"}",
        "Audit1487 retires this complete dated receipt because its source changed; not current execution evidence: {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx --maxWorkers=1\",\"durationSeconds\":3.6,\"summary\":\"Test Files  1 passed (1); Tests  14 passed (14). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"}",
        "Audit1487 historical assertion inventory; not current validated assertions: [{\"file\":\"src/renderer/src/components/sidebar/project-admission/dialog/AddRepoStartSteps.test.tsx\",\"assertions\":[\"host-scoped Add Project actions remain disabled until a paired runtime is selectable\"]},{\"file\":\"src/renderer/src/components/sidebar/project-admission/completion/project-added-default-checkout.test.ts\",\"assertions\":[\"filters loaded, detected, refreshed, and activated default checkouts by the captured execution host when repo IDs collide\"]}]",
        "Audit1488 deletes NonGitFolderDialog tests. The hand-assembled scan/import pipelines, supplied host and folder outcomes, registration callback receipts and static host confirmation alarms are retired. No equivalent replacement coverage or fresh routing validation is claimed. Historical receipts and assertions describe their original sources only.",
        "Audit1488 historical assertion inventory; not current validated assertions: []",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/store/project-groups/nested-repository-operations.test.ts: routes local nested scan progress by scanId and unsubscribes after completion. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2371 reduces all-host-folder-workspace-catalogs.test.ts by removing the repeated offline compatibility-probe budget and its incidental local-fallback/restored-owner samples, and catalog-settlement-notifications.test.ts by removing the four-route ten-equal-refresh notification/reference matrix. Those probe, quietness, identity and fallback alarms are intentionally lost. Remaining stale-response and revision-fencing examples do not supply equivalent replacement coverage. No fresh execution or red/green evidence validates the reduced sources; the four unrelated physical selected-runtime E2E receipts retain their original commands and scope.",
        "Module-layout wave2 intentionally retires complete prohibited owning registrations in src/renderer/src/lib/resolved-worktree-execution-host.test.ts. Lost alarms: Both explicit and legacy workspace owners resolve to env-a initially. Replacing the repo catalog refreshes legacy ownership to env-b. A conflicting local repo row makes ownership ambiguous and returns null. Repeated unrelated updates perform zero id reads, an internal work-budget alarm removed. No equivalent replacement coverage or reduced-selector pass is claimed.",
        "Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: drops older same-host group and folder responses that finish last — Copies group and folder fixtures plus four deferred responses to re-test the same generic catalog generation fence in two wrappers. Retires stale same-host response rejection at these API copies.; drops pre-reconnect group and folder responses without pruning the new catalog — Directly replaces pairing/catalog fixtures then resolves scripted old group/folder replies; repeats identity-fence contract in two catalog wrappers without real reconnect. Retires pre-reconnect catalog pruning refusal example.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3349 retires the explicit runtime-owner, explicit SSH-owner and missing-owner-after-catalog-change examples from worktrees-fetch-owner-routing. Of those four named assertions, only the missing-owner-after-provider-reconnect assertion remains; the command and test-file selector survive. Those three alarms are intentionally lost without equivalent replacement. Four unrelated physical selected-runtime macOS E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh runtime, provider, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3349 historical original assertionRefs object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/store/slices/worktrees/listing/worktrees-fetch-owner-routing.test.ts\",\n          \"assertions\": [\n            \"honors an explicit runtime owner before the repo catalog is hydrated\",\n            \"honors an explicit SSH owner before the repo catalog is hydrated\",\n            \"rejects a missing-owner SSH result after the repo catalog changes\",\n            \"rejects a missing-owner SSH result after the provider reconnects\"\n          ]\n        }",
        "Audit3362 retires the whole settings suite, including dirty-draft focus, background-host keepalive, protocol/catalog compatibility, stale/failure and refresh examples. The compound unit selector and test-file entry narrow; all prior owner-routing retirements/history remain. Four unrelated selected-runtime macOS E2E receipts remain verbatim and do not validate the changed unit selector. No equivalent replacement or fresh runtime/provider/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3362 historical original commands object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts src/renderer/src/store/slices/settings/settings.test.ts src/renderer/src/store/slices/browser/hosts/browser-session-host-selection.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1\"",
        "Audit3362 historical original testFiles object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"src/renderer/src/store/slices/settings/settings.test.ts\""
      ],
      "demotionRule": "Demote or block release if any non-Advanced path mutates Active Server, if local reveal or Add Project depends on the durable default instead of captured workspace/host ownership, if an Add Project operation reaches a different host after it begins, or if transient host state survives restart."
    },
    {
      "id": "terminal-geometry.visible-convergence",
      "title": "Visible desktop terminals converge across xterm, fit, PTY, shell, and runtime mirror size",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-provider-contract",
      "surfaces": [
        "PTY sizing",
        "split layout",
        "restore",
        "hidden-to-visible transitions",
        "window wake"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Local macOS evidence on main@1282f5c2d, including #7192's runtime-mirror geometry authority slice. Deterministic provider-contract coverage now includes settled window-wake reassertion and SSH relay applied-size readback. Live shell-visible SSH/remote geometry and Windows ConPTY readback remain non-blocking gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1371 removes three positive project-setup-folder-remote-identity.spec.ts variants imported by orca-runtime.test.ts. Actual Git mismatch refusal and current-remotes identity callbacks remain unchanged. These are remote-project linking tests, not geometry validation; the complete mixed runtime receipt is archived because its imported selector changed. No equivalent replacement or new geometry evidence is claimed. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6644",
        "https://github.com/stablyai/orca/pull/6649",
        "https://github.com/stablyai/orca/pull/6725",
        "https://github.com/stablyai/orca/pull/6785",
        "https://github.com/stablyai/orca/pull/6853",
        "https://github.com/stablyai/orca/pull/6939",
        "https://github.com/stablyai/orca/pull/7192"
      ],
      "invariant": "A visible desktop-owned terminal cannot trust 0x0, stale requested size, or renderer-only size; xterm, fit/proposed size, applied PTY size, shell-visible size, and the runtime mirror's parse dimensions must converge or enter explicit degraded state, and mirror resize reflow must stay ordered with queued output writes.",
      "oracle": "No current automated execution oracle is claimed after Audit1383 retired changed-selector receipts. Reduced-source assertions await validation. Historical prior oracle: The current executable slice uses deterministic frame schedulers and fake providers to force 0x0 first fit, delayed layout settle, dropped resize/readback drift, hidden-to-visible activation, and window wake. It asserts the renderer forwards a usable size, pty:getSize reports applied rather than merely requested size where available, visibility resume reasserts real drift without hot listSessions, one settled wake produces one geometry-only readback, and SSH relay readback is authoritative with bounded fallback. Shell-visible stty/echo-wrap convergence remains a live-gate follow-up.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Historical prior-selector budget; changed selectors have no new runtime measurement. Unchanged receipts apply only to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1383 changed selectors have no new soak result. Historical account: Deterministic Vitest slices passed locally; no CI soak history yet."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1383 changed test sources; no new red/green validation of reduced selectors. Historical account: #7192 proved the mirror slice red before its fix (snapshot stayed 80x24, queued write parsed at the wrong width). The renderer 0x0/settle slices do not have recorded red runs."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical prior-selector budget; changed selectors have no fresh measurement. The wake hook count test permits two visual fits but exactly one applied-size read per visible pane and no broad visibility/agent lifecycle call. SSH readback has a one-second timeout, caches stable method-not-found, and retries only transient failures. No polling, listSessions scan, subprocess, or unbounded retry was added."
      },
      "promotionCriteria": [
        "Build deterministic fault hooks before adding broad E2E coverage.",
        "Keep stress variants non-blocking until runtime and flake history are known."
      ],
      "knownGaps": [
        "Local and Docker-backed SSH Electron wake specs exist but remain manual/non-blocking pending runtime and flake history.",
        "The deterministic gate proves the SSH provider/relay readback contract, not live shell-visible convergence across every remote path.",
        "Does not yet prove Windows ConPTY geometry/readback.",
        "Current command uses deterministic fake providers for the main/renderer contracts, not a real remote PTY.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-21\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\"result\":\"passed\",\"durationSeconds\":18.54,\"summary\":\"8 test files passed, 1,272 tests passed on the PR branch.\"}",
        "Retired during audit1324 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\"durationSeconds\":26.94,\"summary\":\"Test Files  6 passed (6); Tests  1444 passed | 3 skipped (1447). Focused current selector, single Linux execution; native adapters remain mocked where present. No physical-device, p95, or deployed mixed-host claim. Source head 361cc80b18cbc73bdcda3cc2d67f47aab4b9d2e7.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\"durationSeconds\":27.49,\"summary\":\"Test Files  6 passed (6); Tests  1439 passed | 3 skipped (1442). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 49e2978f83d521bd487e52e0b8b21a1902834caf.\"}",
        "Historical execution before upstream workspace-card relocation refresh; complete original receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\"durationSeconds\":25.32,\"summary\":\"Test Files  6 passed (6); Tests  1439 passed | 3 skipped (1442). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head 4fa83106fcdb5ffd53ad527bf59f83b72aec2285.\"}",
        "Test-value audit1327-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1327-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\n          \"durationSeconds\": 25.44,\n          \"summary\": \"Test Files  6 passed (6); Tests  1439 passed | 3 skipped (1442). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Test-value audit1330-refresh679 removes low-value registrations. Historical receipts below predate the changed selected sources or imported spec drivers and are not evidence for the surviving tests; no replacement-equivalence claim.",
        "Historical receipt before audit1330-refresh679 test removal; complete original record preserved verbatim: {\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\n          \"durationSeconds\": 25.44,\n          \"summary\": \"Test Files  6 passed (6); Tests  1439 passed | 3 skipped (1442). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head aff14a8338e6a649ef28b44458e3545c429613a1.\"\n        }",
        "Audit1371 removes three positive project-setup-folder-remote-identity.spec.ts variants imported by orca-runtime.test.ts. Actual Git mismatch refusal and current-remotes identity callbacks remain unchanged. These are remote-project linking tests, not geometry validation; the complete mixed runtime receipt is archived because its imported selector changed. No equivalent replacement or new geometry evidence is claimed.",
        "Historical receipt retired by audit1372 at 1f0e6b60b1cb31fc3aebaf573da5957297c8c613; original record unchanged, not current validation:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\n          \"durationSeconds\": 29.33,\n          \"summary\": \"Test Files  6 passed (6); Tests  1435 passed | 3 skipped (1438). Focused Linux unit execution; no p95, physical-provider or cross-platform claim. Source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0.\"\n        }",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm --config.verifyDepsBeforeRun=false exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 34.11,\n          \"summary\": \"Test Files  6 passed (6); Tests  1431 passed | 3 skipped (1434). Source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Current retained unit selection only. No removed-case replacement, live provider, native input, rendered Electron E2E, performance threshold or soak claim. Node24.22.0 with ORCA_BACKGROUND_LAUNCH=1 and an isolated Xvfb display. currentCommand retains the same selectors; execution adds a worker limit and disables dependency preflight.\"\n        }",
        "Audit1383 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"linux\"],\"coveredProviders\":[]}. Static assertion references are not current execution evidence.",
        "Audit1383 parent metadata correction: protection=none requires empty active commands and testFiles. Prior selector inventories are historical only, do not establish a current validation gate, and are preserved verbatim as JSON:\n{\n  \"commands\": [\n    \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts src/main/runtime/orca-runtime.test.ts\"\n  ],\n  \"testFiles\": [\n    \"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts\",\n    \"src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts\",\n    \"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts\",\n    \"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts\",\n    \"src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts\",\n    \"src/main/runtime/orca-runtime.test.ts\"\n  ]\n}",
        "Audit1383 parent schema correction: these unrelated static assertion references remain historical and are archived verbatim as JSON because protection=none forbids active assertionRefs. No current execution or replacement coverage is claimed:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts\",\n    \"assertions\": [\n      \"hidden delayed narrow settle is forwarded instead of stopping on a fixed frame budget\",\n      \"unmeasurable frames do not count as settled\",\n      \"applied-size readback divergence is re-forwarded before handoff\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts\",\n    \"assertions\": [\n      \"only one applied-size read stays in flight while the grid changes\",\n      \"stale in-flight targets never resize the PTY back to an older grid\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts\",\n    \"assertions\": [\n      \"0x0 split-right spawn recovers when the container becomes measurable\",\n      \"visible permanently-unmeasurable 0x0 pane gets a nonzero safe fallback\",\n      \"hidden 0x0 background spawn is not forced to phantom desktop size\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts\",\n    \"assertions\": [\n      \"window focus reasserts PTY size after fitting\",\n      \"the immediate and settled wake fits produce exactly one geometry-only reassertion\"\n    ]\n  },\n  {\n    \"file\": \"src/main/ipc/pty/delivery/pty-applied-size-reporting.test.ts\",\n    \"assertions\": [\n      \"accepted desktop resizes fan out to the runtime after provider resize\",\n      \"rejected desktop resizes do not fan out to the runtime\",\n      \"provider-owned null remains unverified instead of falling back to requested size\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/orca-runtime.test.ts\",\n    \"assertions\": [\n      \"the headless mirror resizes after an accepted desktop PTY resize (#7192)\",\n      \"headless mirror resizes are ordered behind queued PTY writes (#7192)\"\n    ]\n  }\n]"
      ],
      "demotionRule": "Cannot promote without deterministic oracle and runtime history."
    },
    {
      "id": "worktree-listing.execution-host-ownership",
      "title": "Worktree listings keep canonical SSH ownership and mutation fencing",
      "maturity": "experimental",
      "protection": "none",
      "owner": "worktree-listing",
      "layer": "main-unit",
      "surfaces": [
        "detected worktree listing",
        "known worktree catalog",
        "worktree list and listAll"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Actual handlers, hydration, ownership, scan cache and provider authority with mocked providers/Git/store/IPC. Independent controls use real lineage pruning and an in-memory map. No physical SSH or native Git.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts"
      ],
      "invariant": "Canonical SSH listings use the owning provider and cannot register remote roots locally or reuse local cache authority. A listing overtaken by a mutation or root revision cannot prune newer lineage.",
      "oracle": "Both SSH owner spellings reach five read forms without local Git/root registration; disconnection and authority rotation invalidate detected answers. Both catalog channels suppress side effects after mutation/root revision. Two direct canonical scans require two provider listings instead of one cached listing.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "Focused mocked-provider unit suites; p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local author/independent/current-main validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Original permanent13fail13controls; repaired26pass. Initial candidate lost actual lineage in2independent races; repaired40pass includes these controls."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No added polling or concurrency; listAll remains bounded at8. Canonical SSH roots avoid local cache/registration. Trade-off:2connected direct scans use2provider listings instead of1cached result. No CPU/latency/heap improvement claim."
      },
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "CI soak pending.",
        "Local and daemon PTY, terminal output and mobile wire are unaffected.",
        "Native Linux/Windows, live SSH/WSL and paired runtime-host integrations not executed. Generic runtime rows retain refusal.",
        "Catalog list/listAll may still return a superseded plain-array snapshot; this gate prevents stale lineage side effects, not all response staleness.",
        "Canonical forgetRemovedForExecutionHost remains outside scope; no new destructive authorization.",
        "Filesystem classifier and registry defects are separate repairs; this gate only prevents listing-induced local-root admission.",
        "Canonical SSH bypasses the improper5second local cache, increasing provider calls. No replacement cache or physical cancellation claim."
      ],
      "promotionCriteria": [
        "Retain exact-owner, no-local-I/O, cache-admission and overtaken-lineage controls; collect CI soak and real provider coverage."
      ],
      "demotionRule": "Keep experimental until soak; investigate host/lineage regressions without weakening ownership assertions or adding blind retries."
    },
    {
      "id": "xterm-addon.boundary-containment",
      "title": "xterm addon failures stay pane-scoped and input survives",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit",
      "surfaces": ["terminal search", "links", "WebGL", "decorations", "keyboard navigation"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1342 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Historical macOS evidence over the WebGL/link/search containment suites on main@1282f5c2d, adopting the #6949 atlas-recovery rename and #7133's reveal hardening tests. Core addon-load throw containment and live typed-input survival arrive with #7004 and a live follow-up. The test-value audit removed the reveal-repaint mock-routing suite, including settled-frame ordering and per-pane failure-isolation alarms. These historical assertions are no longer supplied by that suite; no equivalent coverage is claimed. The audit removes isolated link-provider RangeError reproduction, refresh-cancellation and failed-attach backoff examples. Retained tests cover post-resolution callback ownership and context-loss resume; they do not establish equivalent coverage for the removed examples. Audit1283 removes the private-object context-release example from pane-webgl-refresh-lifecycle.test.ts. Its loseContext/dispose/canvas-zero/null assignment alarms are intentionally lost; the then-retained structural-replay refit timeline did not validate GPU release or equivalent coverage. The prior seven-file selector passed 44 renderer-unit fixture cases on Linux before the remaining refit test was removed. This is separate from the archived macOS receipt and does not validate native GPU release or live Electron typed-input survival. Latest-policy rereview deletes the remaining fabricated-pane structural-replay refit test. The deferred fit/refresh mock-count alarm is intentionally lost; no equivalent coverage is claimed. The current six-file selector has not been run by this static audit. Audit1342: src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts removed. Context resume/reveal retry and deferred rebuild mock-pane alarms disappear. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6852",
        "https://github.com/stablyai/orca/pull/6872",
        "https://github.com/stablyai/orca/pull/6855"
      ],
      "invariant": "Search, link, WebGL, decoration, input-protocol, or keyboard-navigation errors must not unmount the terminal surface, crash React/window, break focus, or stop PTY input/output.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1342 retired changed-source receipts. Historical oracle account: The current executable slice injects a core addon load throw and asserts pane opening continues through later addons, checks that a link provider throwing after it resolves does not deliver the callback twice, covers search decoration positive-integer failures as false results instead of renderer crashes, and covers WebGL attach/refresh/recovery containment. Focused typed input echo after addon failure still needs a live/component follow-up.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1342 retired changed-source receipts; reduced selector has no new soak result. Historical account: Focused renderer-unit containment slice passed locally on 2026-07-02; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation. Historical account: #7133 proved the reveal-hardening slice against live corrupted specimens; the link/search guards reproduce their original crashes in-test. No recorded red runs for the refresh-lifecycle slice. Historical evidence includes assertions subsequently removed in the test-value audit; it does not establish their current coverage."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Historical budget only after Audit1342 changed test sources; no new measurement. Previous account: Required only if containment adds retry loops, polling, or renderer fallback churn."
      },
      "promotionCriteria": [
        "Add deterministic addon throw injection.",
        "Prove input/output survives after boundary failure."
      ],
      "knownGaps": [
        "Current command is renderer-unit containment, not live Electron typed input/output survival after addon failure.",
        "Does not yet inject WebGL dispose/reset throws and active/hidden/resumed pane focus recovery in one component-level oracle.",
        "The test-value audit removed the reveal-repaint mock-routing suite, including settled-frame ordering and per-pane failure-isolation alarms. These historical assertions are no longer supplied by that suite; no equivalent coverage is claimed.",
        "The audit removes isolated link-provider RangeError reproduction, refresh-cancellation and failed-attach backoff examples. Retained tests cover post-resolution callback ownership and context-loss resume; they do not establish equivalent coverage for the removed examples.",
        "Audit1283 removes the private-object context-release example from pane-webgl-refresh-lifecycle.test.ts. Its loseContext/dispose/canvas-zero/null assignment alarms are intentionally lost; the retained structural-replay refit timeline does not validate GPU release or equivalent coverage.",
        "Audit1283 retired the complete 2026-07-03 receipt because the WebGL context-release registration is removed. This historical result does not validate the reduced suite. Original receipt verbatim:\n        {\n          \"date\": \"2026-07-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.8,\n          \"summary\": \"8 test file(s) passed, 33 tests passed on main@1282f5c2d in a clean checkout. Historical command preserved after the test-value audit removed the referenced reveal/repaint or registry recovery assertions. currentCommand is an administrative link; this historical run has not validated the remaining command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\"\n        }",
        "Latest-policy rereview deletes the remaining fabricated-pane structural-replay refit test. The deferred fit/refresh mock-count alarm is intentionally lost; no equivalent coverage is claimed. The current six-file selector has not been run by this static audit.",
        "The complete eaa078f 44-case Linux receipt is retained as historical evidence after removing the refit suite. It does not validate the current six-file selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.12,\n          \"summary\": \"44 renderer-unit cases passed across seven suites on Linux using the current selector, with pnpm dependency verification disabled and two workers. These fixtures do not establish native GPU release or live Electron typed-input survival.\"\n        }",
        "Audit1342: src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts removed. Context resume/reveal retry and deferred rebuild mock-pane alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.85,\n          \"summary\": \"Test Files  6 passed (6); Tests  43 passed (43). Renderer fixtures; no native GPU release or live Electron typed-input survival claim.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts\",\n    \"assertions\": [\n      \"does not double-invoke the callback when the provider throws after resolving\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-search-safe-find.test.ts\",\n    \"assertions\": [\n      \"the xterm positive-integers decoration crash is swallowed while unrelated errors re-throw\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts\",\n    \"assertions\": [\n      \"continues recovery when a manager throws after scheduling\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\",\n    \"assertions\": [\n      \"attach bail disposes the addon instead of orphaning it (#7133 single-addon invariant)\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\",\n    \"assertions\": [\n      \"tab reveal, heavy reveal, and window wake schedule pane-scoped repaint (#7133)\"\n    ]\n  }\n]",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts\",\n    \"assertions\": [\n      \"recovers a context-lost pane on the next rendering resume\"\n    ]\n  }\n]",
        "Retired selector metadata during audit1345; historical selector record preserved unchanged: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\"],\"testFiles\":[\"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts\",\"src/renderer/src/components/terminal-search-safe-find.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts\",\"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\"],\"assertionRefs\":[]}"
      ],
      "demotionRule": "Cannot promote while it only checks visual rendering."
    },
    {
      "id": "terminal-scroll.intent-preservation",
      "title": "Scrollbar drag intent survives tab and visibility resume",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit",
      "surfaces": [
        "terminal lifecycle",
        "hidden-to-visible resume",
        "tab switching",
        "xterm scrollbar DOM",
        "scrollback"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2236: retain only old-terminal disposal refusing to overwrite its keyed successor, and mouse-report classification preserving wheel intent through rebuild. Both use synthetic terminal state. Remove delayed wheel sampling, pinned-growth remount, stale settle, generic rebuild suppression, wheel direction matrix, cleared-buffer durable pin and cancelled rebuild examples. No direct scrollbar/native scroll coverage or equivalent replacement is claimed. Historical dated receipt and budgets remain verbatim and do not validate these reduced source bytes. Historical prior account (preserved verbatim): The audit removes all direct scrollbar pointer-classification, dragged-viewport restoration and terminal-body exclusion examples. Retained wheel/rebuild and keyed-owner fixtures exercise related scroll-intent behavior with synthetic terminal state; they do not provide equivalent scrollbar coverage. The recorded macOS run is historical and is not a rerun of the reduced suite. Live daemon, SSH, WSL, remote-runtime, Linux and Windows scrollbar validation remains unproved.",
      "motivatingLinks": ["STA-1341"],
      "invariant": "A user-driven xterm scrollbar thumb or track scroll updates the live terminal scroll intent before tab, visibility, or layout resume enforces intent, so resume preserves the latest dragged viewport instead of an older pinned line.",
      "oracle": "Audit2236: retain only old-terminal disposal refusing to overwrite its keyed successor, and mouse-report classification preserving wheel intent through rebuild. Both use synthetic terminal state. Remove delayed wheel sampling, pinned-growth remount, stale settle, generic rebuild suppression, wheel direction matrix, cleared-buffer durable pin and cancelled rebuild examples. No direct scrollbar/native scroll coverage or equivalent replacement is claimed. Historical dated receipt and budgets remain verbatim and do not validate these reduced source bytes. Historical prior account (preserved verbatim): No retained unit test directly exercises scrollbar thumb/track targeting or a dragged viewport. The retained deterministic slice checks delayed wheel viewport sampling, keyed disposal/remount ownership, and wheel intent through rebuild completion or cancellation; these checks do not establish scrollbar-drag preservation.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "focused renderer unit test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New experimental gate; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Historical pointer-classification failure claim described examples removed by audit965. No retained red/green artifact proves the scrollbar-drag invariant."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Runtime fix is limited to constant-time class/closest checks on pointerdown. It must not add polling, output parsing, PTY listing, hidden-pane wakeups, resize calls, or startup awaits."
      },
      "promotionCriteria": [
        "Collect stable CI soak history for the renderer-unit gate.",
        "Add stable live Electron automation for the scrollbar drag plus tab-switch repro.",
        "Attach red/green evidence for stale intent restoring the wrong viewport."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 terminal-owner layout and whole-case policy: src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT65 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts\"\n      ]\ntestFiles: [\"src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts\"]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts\",\n          \"assertions\": [\n            \"does not let an old terminal disposal overwrite its keyed successor\",\n            \"keeps rebuild wheel intent when xterm classifies the same event as mouse input\"\n          ]\n        }\n      ]\ncoveredPlatforms: [\"macos\"]\ncoveredProviders: []",
        "NEXT65 historical original evidenceRuns object (verbatim; no current-selector pass credit):\n{\n          \"date\": \"2026-07-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.3,\n          \"summary\": \"1 test file(s) passed, 17 tests passed in this worktree. Audit965 removes the direct scrollbar examples; this command/result remains historical and does not validate the reduced suite or equivalent scrollbar coverage.\"\n        }",
        "Audit2236: retain only old-terminal disposal refusing to overwrite its keyed successor, and mouse-report classification preserving wheel intent through rebuild. Both use synthetic terminal state. Remove delayed wheel sampling, pinned-growth remount, stale settle, generic rebuild suppression, wheel direction matrix, cleared-buffer durable pin and cancelled rebuild examples. No direct scrollbar/native scroll coverage or equivalent replacement is claimed. Historical dated receipt and budgets remain verbatim and do not validate these reduced source bytes.",
        "The manifest command covers narrower deterministic wheel/rebuild/keyed-owner behavior; it does not exercise scrollbar dragging or its DOM target contract.",
        "Live daemon, SSH, WSL, remote-runtime, Linux, and Windows validation is not covered by this gate.",
        "No retained test exercises the scrollbar DOM class contract; changes to .xterm-scrollbar or .xterm-slider targeting have no direct retained alarm.",
        "The audit removes the direct .xterm-scrollbar/.xterm-slider pointer-target, dragged-viewport restoration and terminal-body exclusion examples, along with isolated scroll-intent scalar/snapshot examples. No retained test directly observes those removed scrollbar alarms; related wheel, rebuild and keyed-owner fixtures are not claimed equivalent."
      ],
      "demotionRule": "Demote or quarantine if the unit gate flakes without a product bug or harness bug filed to the owner."
    },
    {
      "id": "terminal-scroll.streaming-refocus-intent",
      "title": "Streaming refocus preserves follow-output viewport intent",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit-and-electron-e2e",
      "surfaces": [
        "terminal lifecycle",
        "window focus recovery",
        "hidden-to-visible resume",
        "xterm write backlog",
        "scrollback"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Unit coverage proves provider-independent ordering for any PaneManager. Live Electron coverage exercises a local PTY through the daemon on macOS; SSH, WSL, remote-runtime, Linux, and Windows remain unproved for this exact race. Audit1299 removes tests/e2e/terminal-streaming-refocus-viewport.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/11753",
        "https://github.com/stablyai/orca/pull/11915"
      ],
      "invariant": "When output is queued during a focus or visibility transition, Orca records the pre-flush viewport intent before xterm parses backlog writes, so a follow-output terminal stays at the bottom and a pinned terminal keeps its prior position.",
      "oracle": "Unit tests require exactly one intent sync before each queued-output flush. The Electron test injects a transient top-of-buffer xterm wobble during refocus and requires every presented scrollbar frame, including the final rendered output, to remain at the bottom.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "focused renderer unit test or one Electron E2E iteration"
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Five consecutive local Electron iterations passed; CI soak history is still required before promotion."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The controlled xterm viewport wobble reproduces the pinned-top failure with post-flush intent sampling and passes when intent is latched before the queued write flush."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Wake recovery keeps one O(panes) intent pass before the existing bounded 64 KiB-per-pane flush. Heavy resume removes its second intent pass and keeps the existing bounded 256 KiB-per-pane flush; no polling, timers, subprocesses, IPC, output parsing, fit, or repaint work is added."
      },
      "promotionCriteria": [
        "Collect stable CI soak history for the Electron race gate.",
        "Run the live oracle on Linux and Windows terminal backends.",
        "Add live SSH or remote-runtime coverage for queued output during refocus."
      ],
      "knownGaps": [
        "The deterministic wobble uses xterm private buffer state and must be updated if that internal contract changes.",
        "Live Linux, Windows, SSH, WSL, and remote-runtime execution is not covered for this exact race.",
        "The Electron gate proves follow-output behavior; adjacent scroll-intent coverage protects pinned viewport behavior.",
        "Audit1299 removes tests/e2e/terminal-streaming-refocus-viewport.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
        "Archived retired-suite historical receipt (JSON, original fields/results unchanged): {\"date\":\"2026-08-01\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-streaming-refocus-viewport.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=5\",\"result\":\"passed\",\"durationSeconds\":35.2,\"summary\":\"Five consecutive Electron iterations passed after replacing fixed-time readiness and stale tab capture with deterministic viewport and pane-identity oracles.\"}",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n        \"pnpm exec electron-vite build --mode e2e\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n          \"assertions\": [\n            \"window-wake recovery synchronizes viewport intent exactly once before flushing queued output\",\n            \"heavy visibility resume synchronizes intent exactly once before flushing queued output\"\n          ]\n        }\n      ]\ncoveredPlatforms: [\"macos\"]\ncoveredProviders: [\"local\", \"daemon\"]",
        "NEXT46 historical original evidenceRuns object (verbatim; no current-selector pass credit):\n{\n          \"date\": \"2026-08-01\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.096,\n          \"summary\": \"14 tests passed, including exact sync count and pre-flush ordering for wake and heavy visibility resume.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\"\n        }"
      ],
      "demotionRule": "Demote or quarantine if the Electron oracle flakes without a product bug or harness bug filed to terminal-rendering."
    },
    {
      "id": "startup-upgrade.persisted-session-corpus",
      "title": "Current Orca preserves or recovers old production persisted sessions",
      "maturity": "experimental",
      "protection": "none",
      "owner": "startup-persistence",
      "layer": "upgrade-fixture",
      "surfaces": ["startup", "upgrade", "session restore", "daemon restore"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): A macOS Electron journey materializes the immutable legacy workspace-session fixture over a live update-surviving daemon PTY, boots current Orca without a current-format session write, and proves the terminal title, marker output, exact PTY, tab identity, repo, and worktree survive both the upgrade launch and a second current-version relaunch. Linux, Windows, SSH, and WSL fixture journeys remain uncollected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/5356",
        "https://github.com/stablyai/orca/pull/5234",
        "https://github.com/stablyai/orca/pull/5240"
      ],
      "invariant": "Startup and restore fixes must preserve or explicitly recover sessions from the last affected production persisted-state schema, not only from state written by current code.",
      "oracle": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Boot current Orca against immutable copied user-data fixtures from affected versions and reject blank replacement panes, duplicate resume tabs, silent session loss, or works-only-after-current-write behavior.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused Electron upgrade fixture"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "One focused local macOS Electron run passed; CI soak history is not collected."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): The immutable legacy-shaped fixture and first-write/second-restart oracle are executable; saved intentional-break red/green evidence is still required."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Startup fixture must record startup latency and avoid adding blocking migration scans."
      },
      "promotionCriteria": [
        "Land immutable old-version fixture with documented source version.",
        "Run second restart after current code writes upgraded state.",
        "Record startup timing and failure artifact."
      ],
      "knownGaps": [
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. The only passing receipt is retired, so protection becomes none pending a fresh run. Original current selectors and assertion inventory, preserved as historical data only: {\"commands\":[\"SKIP_BUILD=1 pnpm run test:e2e -- tests/e2e/persisted-session-production-upgrade.spec.ts\"],\"testFiles\":[\"tests/e2e/persisted-session-production-upgrade.spec.ts\"],\"assertionRefs\":[{\"file\":\"tests/e2e/persisted-session-production-upgrade.spec.ts\",\"assertions\":[\"upgrades a legacy daemon session and keeps it stable after relaunch\"]}],\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"daemon\"]}. No claim that retained test bodies disappeared. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"SKIP_BUILD=1 pnpm run test:e2e -- tests/e2e/persisted-session-production-upgrade.spec.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 16.7,\n          \"summary\": \"The legacy-shaped session retained its exact daemon PTY, terminal output marker, tab, repository, and worktree through the upgrade launch and a second current-version relaunch.\"\n        }",
        "The corpus currently contains one minimized legacy local-daemon workspace session.",
        "Linux, Windows, SSH, and WSL upgrade fixtures remain uncollected.",
        "The setup uses a current binary to create the live daemon PTY that stands in for the pre-upgrade process; it does not launch an installed legacy artifact."
      ],
      "demotionRule": "Cannot promote without old production fixture provenance."
    },
    {
      "id": "terminal-platform.live-pty-liveness",
      "title": "A real Electron local PTY accepts input, survives workspace restore, resizes, and exits cleanly",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "electron-live-pty",
      "surfaces": [
        "active terminal PTY binding",
        "xterm focus",
        "keyboard input",
        "PTY output",
        "workspace hide and restore",
        "resize",
        "exit cleanup"
      ],
      "platforms": ["linux", "macos"],
      "providers": ["local"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap on main. The live Electron Playwright slice exists only on the pending reliability stack. It registers here with its owning split PR.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6801",
        "https://github.com/stablyai/orca/pull/6842",
        "https://github.com/stablyai/orca/pull/6939",
        "https://github.com/stablyai/orca/pull/6989"
      ],
      "invariant": "An active local Electron terminal has one active PTY id listed exactly once, accepts real keyboard input through focused xterm, renders process output visibly, keeps the same live PTY across repeated workspace hide/restore cycles, applies an actual size change, and removes the old PTY from liveness state after exit.",
      "oracle": "A deterministic raw-mode probe prints a ready marker, ordered key markers from real keyboard input, the active PTY id appears exactly once in pty:listSessions, remains bound to the same PTY id across two worktree switch-away/switch-back cycles, accepts more keyboard input after each restore, changes pty:getSize after viewport resize, prints the same process-visible size, and prints an exit marker; after shell exit, pty:listSessions no longer contains the old id.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 75,
        "scope": "focused Electron live PTY gate including e2e build/setup"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused Playwright gate passed locally after adding two workspace hide/restore cycles, exact active-PTY listing, and actual resize convergence on 2026-07-02: 1 test passed, 8.6s test body, 58.6s full command including build/setup. Needs repeated CI/runtime history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The gate asserts PTY binding, active PTY listed exactly once, real xterm keyboard delivery, same-PTY ownership across repeated workspace hide/restore cycles, post-restore input delivery, actual pty:getSize change, matching process-visible size, and listSessions cleanup after shell exit. Needs saved intentional-break evidence before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Must record key latencies, size snapshots, and final liveness state. The gate may use broad listing as a test oracle; product hot paths must not use broad provider listing as a synchronization primitive."
      },
      "promotionCriteria": [
        "Implement without blind sleeps; wait only on PTY binding, probe markers, size marker, and liveness absence.",
        "Run in soak on Linux before blocking; keep macOS as soak until stable.",
        "Attach red/green evidence for focus, PTY write, resize, and exit cleanup failures."
      ],
      "knownGaps": [
        "No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
        "Needs soak/runtime history before promotion.",
        "Does not yet cover tab switch inside one worktree, scrollback after restore, or app restart persistence.",
        "Does not cover Windows ConPTY, SSH, WSL, daemon, or remote-runtime providers."
      ],
      "demotionRule": "Cannot promote without deterministic user-visible oracle, failure artifacts, and stable runtime history."
    },
    {
      "id": "terminal-session.windows-main-crash-survival",
      "title": "A Windows main-process crash preserves and reattaches daemon terminals",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-platform",
      "layer": "windows-packaged-electron-daemon",
      "surfaces": [
        "Electron main-process crash",
        "detached terminal daemon",
        "ConPTY shell survival",
        "packaged relaunch reattach"
      ],
      "platforms": ["windows"],
      "providers": ["daemon"],
      "coveredPlatforms": ["windows"],
      "coveredProviders": ["daemon"],
      "coverageNotes": "A packaged Windows CI run force-kills the launched instance's real Electron main without tree-killing, then proves the same scoped daemon and interactive PowerShell survive, no FailFast event is observed, and relaunch input reaches the same shell.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/7742",
        "https://github.com/stablyai/orca/pull/9311"
      ],
      "invariant": "On packaged Windows, abrupt death of Orca's Electron main process must not terminate or replace the userData-scoped terminal daemon or its live ConPTY shell, and a relaunch must adopt that exact daemon and route terminal input to that exact surviving shell without a PowerShell 0xE9 FailFast.",
      "oracle": "Resolve the launched instance's real main PID from inside Electron, force-kill only that PID, require it to die, require one command-line-scoped daemon PID and the stamped interactive shell PID to remain live, relaunch with persisted state, require the daemon PID to remain identical, read the exact shell PID and a per-shell environment sentinel back through the exact restored tab, then require a successful Windows Application event-log query with zero matching pwsh FailFast events across the full crash-to-input window.",
      "commands": [
        "node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8"
      ],
      "testFiles": ["tests/tools/win-crash-survival-e2e/run.mjs"],
      "assertionRefs": [
        {
          "file": "tests/tools/win-crash-survival-e2e/run.mjs",
          "assertions": [
            "force-killing only the real Electron main leaves the exact scoped daemon and stamped interactive shell alive",
            "packaged relaunch adopts the unchanged daemon and reads the survivor shell's environment sentinel through the restored terminal"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-18",
          "runner": "ci",
          "platform": "windows",
          "command": "node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8",
          "result": "passed",
          "durationSeconds": 61,
          "summary": "The packaged branch build's real main died; the same daemon and shell PIDs survived; the event-log scan found zero FailFast events; relaunch adopted the unchanged daemon; and terminal input read the survivor shell sentinel back."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "installed-app crash/relaunch harness, excluding installer build and dependency setup"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "One green packaged Windows CI run is recorded; the durable pull-request trigger must accumulate repeated history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The inverse orphaned profile failed against the fixed packaged build because the daemon stayed live and no FailFast occurred. A genuinely pre-relocation packaged build has not yet been retained as a CI red fixture."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Production code is unchanged. The harness has bounded 500ms liveness polls, one 8-second crash soak, two scoped daemon identity scans plus teardown rediscovery, a 60-second cap on every synchronous PowerShell probe, a 5-second cap on Electron main-PID resolution, cleared and unreferenced close deadlines, a 50-minute job timeout, concurrency cancellation, and targeted production-path filtering that excludes source tests and benchmarks. The installer cache is keyed by every production build input; the job also restores the pnpm store and restores Electron/NSIS downloads only when an installer rebuild is required. The measured packaged harness completed in 61 seconds."
      },
      "promotionCriteria": [
        "Collect at least 100 consecutive targeted Windows PR or soak passes over 14 days with zero unexplained flakes.",
        "Retain a pre-relocation packaged red fixture or equivalent fault injection that makes the survival profile fail for daemon death and shell loss.",
        "Keep the live oracle fail-closed for crash delivery, event-log access, daemon identity, and same-shell reattach."
      ],
      "knownGaps": [
        "The packaged journey proves one terminal end to end; concurrent restoration across the user's multi-terminal, multi-worktree layout is not exercised live.",
        "The gate covers a Windows local daemon-backed PowerShell terminal; WSL-backed shells are not exercised.",
        "SSH, remote-runtime, relay, mobile, macOS, and Linux paths are unaffected by the Windows relocated ConPTY host contract and are not exercised here.",
        "The Application event-log query is machine-wide, so an unrelated PowerShell crash on a non-isolated runner can false-fail the gate.",
        "Standalone daemon self-crash and renderer-only crash containment remain separate invariants."
      ],
      "demotionRule": "Keep experimental or quarantine with a linked harness defect if the Windows job flakes; never weaken the crash, identity, event-log, or same-shell reattach oracle to obtain a pass."
    },
    {
      "id": "terminal-platform.windows-conpty-liveness",
      "title": "Windows ConPTY terminals stay input-live, render-live, and geometry-live",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-platform",
      "layer": "windows-electron-conpty",
      "surfaces": [
        "Windows ConPTY",
        "PowerShell and cmd",
        "keyboard protocol",
        "CJK repaint",
        "cursor and resize"
      ],
      "platforms": ["windows"],
      "providers": ["local", "daemon", "wsl"],
      "coveredPlatforms": ["windows"],
      "coveredProviders": ["daemon"],
      "coverageNotes": "Audit1713 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Issue #8048 now has deterministic wrapper and cold-restore re-anchor tests plus a Windows PR-CI harness that drives the built daemon through 25 real ConPTY workspace-close races while an unrelated witness PTY stays alive. A Windows-only patched-node-pty test injects EAGAIN on one ConPTY input pipe and requires only that PTY to close while an unrelated PTY remains writable. Keyboard reset, CJK repaint, WSL, and full visible Electron coverage remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6541",
        "https://github.com/stablyai/orca/pull/6858",
        "https://github.com/stablyai/orca/pull/6876",
        "https://github.com/stablyai/orca/pull/6968",
        "https://github.com/stablyai/orca/pull/6970",
        "https://github.com/stablyai/orca/pull/6999",
        "https://github.com/stablyai/orca/issues/8048",
        "https://github.com/stablyai/orca/issues/17027"
      ],
      "invariant": "Windows local and daemon terminals must spawn with the intended shell, survive overlapping graceful/forced workspace teardown without affecting unrelated PTYs, contain an asynchronous ConPTY input-pipe failure to the affected terminal without killing the daemon, retain recovered scrollback across the fresh daemon's first checkpoint, accept normal Enter/Backspace/Arrow input after agent or TUI exit, render cursor/CJK/wide-glyph redraws without stale cells, and converge to nonzero applied size.",
      "oracle": "Audit1713 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The issue #8048 slice asserts one node-pty ConPTY close for a graceful-then-force sequence, atomically seeds recovered history before fresh shell output and re-anchoring, preserves recovery after seed failure plus adapter restart, and runs 25 built-daemon close races while checking victim session/PID reaping, a stable daemon PID, and a live witness PTY. The EAGAIN slice emits an error from one real patched node-pty Windows input socket, requires its terminal to become unwritable and run the normal per-PTY kill path, then writes through an unrelated PTY without an uncaught exception. A broader Windows live gate still needs shell input, resize, cursor, and CJK/wide-glyph pixel evidence.",
      "commands": [
        "pnpm vitest run src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/node-pty-windows-input-error.win32.test.ts",
        "pnpm build:electron-vite && node config/scripts/diagnostics/runtime-lifecycle/windows-daemon-workspace-close-repro.mjs",
        "node config/scripts/diagnostics/runtime-lifecycle/windows-daemon-workspace-close-repro.mjs"
      ],
      "testFiles": [
        "src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "src/main/daemon/pty-subprocess/testing/node-pty-windows-input-error.win32.test.ts",
        "config/scripts/diagnostics/runtime-lifecycle/windows-daemon-workspace-close-repro.mjs"
      ],
      "assertionRefs": [
        {
          "file": "config/scripts/diagnostics/runtime-lifecycle/windows-daemon-workspace-close-repro.mjs",
          "assertions": [
            "all 25 victim sessions and OS PIDs are reaped while the built daemon PID and an unrelated witness PowerShell remain alive"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-10",
          "runner": "local",
          "platform": "windows",
          "command": "node config/scripts/windows-daemon-workspace-close-repro.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-lifecycle/windows-daemon-workspace-close-repro.mjs",
          "result": "passed",
          "durationSeconds": 7.6,
          "summary": "All 25 victim sessions and OS PIDs were reaped while the built daemon and witness PTY survived the real ConPTY workspace-close races. The double-close, history ordering, and seed-failure restart regressions produced intentional red failures before their fixes and passed afterward."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Windows focused Electron ConPTY gate"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The built-daemon issue #8048 harness passed locally once and is wired into Windows PR CI; it needs repeated CI history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The ConPTY double-close and cold-restore re-anchor assertions were each observed failing before the fix and passing afterward. Keyboard protocol, shell resolution, resize, and CJK repaint still need red/green proof."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Must include input latency and no broad session listing while typing or switching terminals."
      },
      "promotionCriteria": [
        "Start as Windows nightly/soak because Windows Electron E2E has been flaky.",
        "Use deterministic PTY markers for input/resize and reserve screenshots for repaint diagnostics.",
        "Split shell parity, keyboard reset, and CJK repaint into smaller gates if a combined gate is flaky."
      ],
      "knownGaps": [
        "Audit1713 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Real IME composition may require a separate lower-layer/native-text-forwarding gate.",
        "The EAGAIN oracle injects the real input socket event rather than inducing kernel resource exhaustion on a packaged Windows host.",
        "The built-daemon harness proves process/session liveness but not renderer pixels; visible shell input, resize, cursor, and CJK repaint remain uncovered."
      ],
      "demotionRule": "Cannot promote while Windows E2E is flaky, silently skipped, or screenshot-only."
    },
    {
      "id": "terminal-performance.cold-restore-replay-budget",
      "title": "Daemon cold restore keeps replay work and retained payloads bounded",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "main-daemon-unit",
      "surfaces": [
        "startup restore",
        "daemon history replay",
        "sleep and hibernation restore",
        "main-process memory"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic main-process tests cover byte-bounded cache eviction and ACK release, one-at-a-time replay admission, a fixed per-turn replay budget within one large output record, UTF-16 boundary preservation, and checkpoint-only restore bypass while another replay is paused. The same HistoryReader path carries WSL context, but live WSL and cross-platform startup-scale runs remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/9971",
        "https://github.com/stablyai/orca/pull/9990",
        "https://github.com/stablyai/orca/issues/9441"
      ],
      "invariant": "Cold restore must reproduce persisted terminal output while admitting at most one scratch-emulator replay, yielding after at most 64 Ki UTF-16 code units or 1,024 replay operations, keeping sticky restore payloads within 16 MiB, and allowing header-only checkpoint restores to bypass the replay queue.",
      "oracle": "Pause setImmediate during two single-batch restores larger than one replay slice and require exactly one admitted yield at a time, preserved text across a surrogate-pair slice boundary, and a concurrent header-only checkpoint restore to finish without consuming a replay slot. Cache tests require least-recently-used eviction, rejection of one oversized payload, and zero retained cache bytes after renderer ACK.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "focused main-process cold-restore unit contract"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The focused deterministic slice is new and has no CI or soak history yet."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "The prior implementation had no yield inside one large batch and queued header-only restores behind the shared semaphore by inspection; an intentional pre-fix test run was not recorded."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Production admits one emulator replay globally, yields after a deterministic 64 Ki character or 1,024-operation budget even within one record, bypasses the semaphore for the common header-only final-checkpoint path, and caps sticky payloads at 16 MiB. No polling, subprocess, session inventory, or renderer wake loop is added."
      },
      "promotionCriteria": [
        "Record an intentional-break red run for both the within-record yield and header-only bypass assertions.",
        "Collect startup event-loop-delay evidence with dozens of near-cap histories on representative macOS, Windows, and Linux hardware.",
        "Add live WSL restore evidence before claiming WSL coverage."
      ],
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The log decoder and final headless snapshot serialization remain synchronous inside the one-at-a-time replay slot; the gate bounds replay writes, not every CPU phase.",
        "No live Electron startup-scale run currently proves first-pane paint order or end-to-end restore latency with dozens of histories.",
        "SSH, remote-runtime, relay, and mobile do not use this local daemon history reader and are unaffected."
      ],
      "demotionRule": "Keep experimental or demote to protection none if output differs across replay slices, header-only restores consume a replay slot, retained payload bytes exceed the cap, or the focused gate flakes."
    },
    {
      "id": "terminal-performance.remote-hidden-retention-budget",
      "title": "Paired terminals park client renderers while host PTYs preserve bounded history",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "paired-headed-and-headless-runtime",
      "surfaces": [
        "paired remote terminal first paint",
        "paired remote terminal ordinary parking",
        "paired remote terminal bounded scrollback restore",
        "stalled paired terminal stream recovery",
        "snapshot-probe sequence gap recovery",
        "hidden remote worktree retention",
        "remote terminal reveal and input",
        "paired host relaunch with preserved daemon PTYs",
        "paired host session inventory publication authority",
        "paired host session inventory subscription linearizability",
        "manual server disconnect"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["paired-runtime", "ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts, src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2162: Reduced inventory-authority source intentionally loses the examples recorded in knownGaps; historical execution is not validation of changed bytes. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Module ownership cleanup retires the modeled cold-park private watcher/render/work-count suites under the current test policy. Their assertions are no longer active evidence. Retained lifecycle tests and headed/headless journeys do not establish equivalent coverage for those removed harness alarms. Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1412 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/8652",
        "https://github.com/stablyai/orca/pull/10625"
      ],
      "invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. An empty headed session-tab inventory is authoritative only after the current renderer graph generation publishes a complete inventory and every execution host answers the PTY census; unpublished, resync-pending, transport-failed, and partially scoped inventories remain unverifiable, while genuinely authoritative empty and non-empty inventories settle and a scope-less legacy empty keeps its pre-authority best-effort settle so outdated hosts retain agent auto-resume. The unpublished-empty regression must keep the resume dispatch parked with exactly one daemon process/writer; restoring unconditional empty hydration must release one dispatch and create two live writers. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect. A paired pane reconnecting to a relaunched host that has not yet published its window graph (an unpublished frame, bare or client-projected) must stay in recovery rather than retire, and the host's first published snapshot carrying the surface must reattach it; a published frame lacking the surface still retires it. The placeholder is only ever sent before the host's graph first publishes; afterwards a worktree with no tabs gets a real empty answer, pushed once to any client that asked during startup, so a paired client opening a never-opened host worktree still gets its first terminal.",
      "oracle": "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1",
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts",
        "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
        "src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
        "src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts",
        "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts",
        "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
        "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
        "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
        "src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts",
        "src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts",
        "src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts",
        "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts",
        "src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts",
        "src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts",
        "src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
        "src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts",
        "src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
        "tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts",
        "tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts",
        "tests/e2e/paired-remote-terminal-stall-recovery.spec.ts",
        "tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts",
        "tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts",
        "tests/e2e/paired-remote-terminal-retention-memory.spec.ts",
        "tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts",
        "tests/e2e/terminal-parked-memory.spec.ts",
        "tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts",
        "tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts",
        "src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts",
        "tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
          "assertions": [
            "real OSC9999 hook status remains live through title heartbeats without resetting stateStartedAt, then loses unverifiable prompt metadata after its original lease expires"
          ]
        },
        {
          "file": "src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts",
          "assertions": ["retries an existing subscriber when provider inventory becomes ready"]
        },
        {
          "file": "src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts",
          "assertions": [
            "creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed",
            "post-boundary creation and removal replay after the initial snapshot in sequence order",
            "create/remove/recreate transitions are preserved without collapse",
            "a post-boundary projected-state change is delivered without a new snapshot revision",
            "an older coalesced callback cannot overwrite a newer immediate change",
            "initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection",
            "disconnect aborts the census and removes the real runtime listener"
          ]
        },
        {
          "file": "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts",
          "assertions": [
            "unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer",
            "an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes",
            "re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts",
          "assertions": [
            "preserves daemon PID and target PTY identity across the paired host relaunch",
            "foregrounds the daemon-backgrounded target on its first post-relaunch remote observation",
            "delivers target and post-relaunch control terminal input and live output"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts",
          "assertions": ["replaces a stale paired stream when the PTY snapshot advanced"]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-stall-recovery.spec.ts",
          "assertions": [
            "restarts one ACK-starved paired terminal stream without replacing its PTY"
          ]
        },
        {
          "file": "tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts",
          "assertions": ["recovers an ACK-starved stream from an isolated headless Orca host"]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts",
          "assertions": [
            "a nonempty lossy initial snapshot paints exactly once on a paired client",
            "the authoritative host cursor advances and live output resumes exactly once"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts",
          "assertions": [
            "paints a paired remote terminal when only its retained text tail overflowed",
            "legacy paired hosts retain the lossy hidden-manager budget fallback"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-retention-memory.spec.ts",
          "assertions": [
            "ordinary-parks paired terminals and restores authoritative host scrollback",
            "warm-mounted hidden paired streams schedule zero renderer output work under sustained host output",
            "six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport",
            "client recovery completes while every target terminal remains unmounted in the host renderer"
          ]
        },
        {
          "file": "tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts",
          "assertions": [
            "ordinary-parks paired terminals against an isolated headless Orca host",
            "cold-activates only visible paired terminals against an isolated headless host",
            "the headless host bounds real-PTY decorative title transport and production store application",
            "the headless host shares the zero-hidden-renderer-work and exact-restoration contract"
          ]
        },
        {
          "file": "tests/e2e/terminal-parked-memory.spec.ts",
          "assertions": [
            "releases un-parkable hidden worktree buffers only once the retention budget engages"
          ]
        },
        {
          "file": "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
          "assertions": [
            "admits 128 active streams, rejects the 129th, and reuses released capacity",
            "reserves PTY wait capacity independently from active streams"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts",
          "assertions": [
            "keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot"
          ]
        },
        {
          "file": "src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
          "assertions": [
            "keeps pairing while manual disconnect fences passive reconnects",
            "returns a disconnect envelope when a queued active runtime call disconnects",
            "returns a disconnect envelope when a queued selected environment call disconnects"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-10",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 27.6,
          "summary": "The isolated headed desktop host and separate encrypted paired client drove 180 timed decorative real-PTY titles across six hidden worktrees and observed exactly 12 semantic transport envelopes and 12 production store title mutations, then reduced six managers to one, stayed within heap/cell/timer budgets, restored the bounded host tail exactly, and continued input/output while the host renderer retained zero target managers.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-08-10",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 33.9,
          "summary": "The isolated headless `orca serve` host passed the same six-worktree real-title transport/store bound, parking, and exact-restoration oracle; a second scenario proved cold activation mounted only the visible paired terminal.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-07",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1",
          "result": "passed",
          "durationSeconds": 126,
          "summary": "Ten consecutive isolated host-relaunch journeys preserved the daemon and PTY identities and resumed terminal input plus live output after the paired transport recovered.",
          "currentCommand": "ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1"
        },
        {
          "date": "2026-08-07",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 12.5,
          "summary": "With the parking override captured by both host launches, the isolated headed host and separate paired desktop client retained the daemon PID and PTY ID across host relaunch, emitted one target foreground transition, and delivered target plus post-relaunch control input/output. The byte-identical run with only the unknown-state fix reverted failed at the missing target foreground transition.",
          "currentCommand": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-02",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 13.7,
          "summary": "The isolated headed desktop host and encrypted paired web client kept hidden renderer work bounded, ordinary-parked five of six real PTYs, restored the authoritative tail once, preserved PTY identity, and resumed live input/output.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-08-02",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 31.4,
          "summary": "Both isolated headless `orca serve` scenarios passed: ordinary parking restored authoritative history and cold activation mounted only the visible paired terminal.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-07-30",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 17.3,
          "summary": "The headed paired oracle dropped and acknowledged output only for the original client stream, proved the fixture consumed input while the host model advanced and the client stayed stale, then replaced the stream, repainted exact fixture output, preserved authoritative PTY identity and target-tab cardinality, and resumed live I/O.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 11.4,
          "summary": "The headed paired-server scenario painted a truncated retained history after reload; the capability-disabled legacy fallback scenario is skipped unless explicitly selected.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 18,
          "summary": "The byte-identical headed oracle exhausted one paired stream, proved host/client divergence, then repainted the marker while preserving the original PTY and tab.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 14.5,
          "summary": "Six real paired worktrees and host PTYs ordinary-parked five client xterms with the lossy budget disabled, released at least 55% of staged cells within heap and timer-lag budgets, then restored requested row 4,000, parked-time output, and live I/O on the original PTY while every target terminal remained unmounted in the host renderer.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 14.4,
          "summary": "An isolated `orca serve` host and paired web renderer exhausted one terminal stream, recovered it, and preserved the original PTY and tab without exposing readiness or pairing material.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-30",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 23,
          "summary": "The isolated headless `orca serve` host passed ordinary parking plus cold activation: deferred tabs stayed unmounted until activation, preserved PTY identity and parked output, and resumed live input.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 18.6,
          "summary": "A host without terminal.paired-parking.v1 preserved the existing lossy limit-one fallback, restored retained output, and continued PTY input/output.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        },
        {
          "date": "2026-07-30",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 17.5,
          "summary": "The headed six-PTY oracle kept all warm-mounted hidden streams at zero renderer scheduler enqueues/drains under sustained output and under 500 ms timer lag, then restored the authoritative flood tail and parked/live markers exactly once.",
          "currentCommand": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 360,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. No fresh changed-selector soak result. Historical account: Changed selectors have no new soak result after Audit1412; any retained unchanged-source receipts apply only to their own commands. Historical account: The host-relaunch oracle passed a fresh 10-run local series. One earlier exploratory repeat timed out in transport recovery before terminal input/output assertions; it did not recur with forwarded app logs. A later Linux CI run reproduced missing live output when inventory overlapped the refused in-flight attach, which now has a deterministic unit oracle and is pending cross-platform rerun. Broader headed/headless parking coverage has no aggregated CI or soak history yet."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. No fresh red/green result for changed selectors. Historical account: Audit1412 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The six-PTY ordinary-parking oracle was red in two independently observed stages: the parked paired remount first used detached attach and restored only rows 5,963–5,999, then the requested snapshot still lost to the current-screen replay until park reveals explicitly entered the capability-gated reattach coordinator. The candidate is green on headed and headless hosts, while disabling terminal.paired-parking.v1 makes the byte-identical oracle fail at its capability precondition and leaves the separately tested legacy lossy fallback green. The parked-title production-parity control throws Maximum update depth exceeded on the affected parking synchronization and settles with semantic dependencies; forced memo-cache discard, StrictMode cleanup replay, and split-PTY replacement are independently red before their corrections and green on the combined candidate. The real-PTY session-tabs oracle produces 96 full snapshots, 64,032 serialized bytes, 96 renderer applies, and 96 store mutations on unmodified main and on a one-line causal revert before reaching the alternating native-title phase; the candidate produces zero in all four dimensions while preserving all 2,880 redraw chunks and 24 exact semantic transitions. The 64-PTY decorative-title control delivered 576 client events after convergence on unmodified main; the candidate delivers zero while preserving all 640 local frames, one current frame to a late client, and bell/idle transitions to both clients. The legacy no-output-pause control failed to request a reveal snapshot and kept hidden bytes on the xterm path; the candidate gates those bytes locally and restores one authoritative snapshot before live output. With stalled-stream recovery disabled, the host cursor advanced but the client remained frozen; enabling it repainted the marker with the same PTY and tab. The sequence-gap unit and headed paired oracle are red on current main and with only the new probe decision reverted: the authoritative host advances while the client stays stale after a successful probe. The candidate replaces the stream, repaints the marker, preserves PTY identity, and resumes I/O. Reverting the active-stream limit to 64 makes the exact 128-stream contract fail at 64; restoring 128 admits every intended stream, rejects 129, and reattaches it after one slot releases. The host-relaunch oracle fails when unknown delivery state is coerced to foregrounded or a layout version becomes an output high-water; the candidate foregrounds the preserved daemon PTY once and resumes same-PTY input/output. When authoritative inventory overlaps a refused in-flight attach, removing only the post-settlement retry leaves the existing subscriber without daemon output; the candidate retains one waiter across repeated inventory publications, retries exactly once, and restores live output."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Historical pre-audit selector account; changed selectors have no new measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Before ordinary parking, six warm-mounted hidden paired xterms receive zero raw frames and schedule zero renderer output drains while host models continue ingesting sustained output. The headed and headless production transports each admit only the initial and final semantic title snapshots per worktree across 180 timed decorative frames, and the real store performs only those 12 exact title mutations. Ordinary parking then retains the host PTY and bounded 5,000-row provider model while destroying five client xterms. Parked watcher synchronization is keyed by bounded parking semantics rather than fresh object identities; unrelated store writes perform zero PTY-map reads when no tab is parked, while parked reconciliation remains bounded by the worktree's terminal tabs and assignments. Decorative title ticks are collapsed both on the paired client-event channel and at the authoritative real-PTY session-tabs classifier before snapshot construction, serialization, transport, recovery, or store application; semantic facts remain exact. Headed and headless oracles require exact reduction from six managers to one, at least 55% staged xterm-cell release, no more than 16 MiB heap growth, and under 500 ms timer drift. The forced hidden-worktree retention policy keeps at most four otherwise un-parkable worktrees mounted and force-parks all after 15 minutes; the separate ordinary hot-retain policy keeps at most four recently visible worktrees warm for five minutes. Legacy hosts still gate hidden raw output before xterm scheduling and restore from a bounded snapshot on reveal. Stream recovery adds no polling and is scoped to one stream. Provider-ready reconciliation runs only for PTYs returned by a successful controller inventory, requires an existing remote subscriber, and retains at most one post-settlement waiter per PTY while attach deduplication remains active."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history for the headed and headless parking commands.",
        "Run the paired topology on Windows and Linux and add one live SSH retention run.",
        "Run the stream-stall oracle with a v1.4.160-rc.3 host and v1.4.160-rc.4 client.",
        "Add a production-scale paired run with dozens of worktrees and explicit event-loop and renderer-memory budgets.",
        "Keep the budget-off control, exact manager count, final bounded-tail flood marker, parked-time output, and post-reveal PTY input in both topology runs."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT65 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n        \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n        \"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n        \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n        \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts\",\n        \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts\",\n        \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts\",\n        \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/terminal-parked-memory.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts\",\n        \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n          \"assertions\": [\n            \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n            \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n            \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n            \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n            \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n            \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n            \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n            \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n            \"tracked terminal state reset clears delayed foreground ownership markers\",\n            \"raw chunks, semantic idle transitions, and visible output remain exact\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n          \"assertions\": [\"retries an existing subscriber when provider inventory becomes ready\"]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n          \"assertions\": [\n            \"creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed\",\n            \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n            \"create/remove/recreate transitions are preserved without collapse\",\n            \"a post-boundary projected-state change is delivered without a new snapshot revision\",\n            \"an older coalesced callback cannot overwrite a newer immediate change\",\n            \"initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection\",\n            \"disconnect aborts the census and removes the real runtime listener\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n          \"assertions\": [\n            \"unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer\",\n            \"an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes\",\n            \"re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n          \"assertions\": [\n            \"preserves daemon PID and target PTY identity across the paired host relaunch\",\n            \"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation\",\n            \"delivers target and post-relaunch control terminal input and live output\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n          \"assertions\": [\"replaces a stale paired stream when the PTY snapshot advanced\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\n            \"restarts one ACK-starved paired terminal stream without replacing its PTY\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\"recovers an ACK-starved stream from an isolated headless Orca host\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n          \"assertions\": [\n            \"a nonempty lossy initial snapshot paints exactly once on a paired client\",\n            \"the authoritative host cursor advances and live output resumes exactly once\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n          \"assertions\": [\n            \"paints a paired remote terminal when only its retained text tail overflowed\",\n            \"legacy paired hosts retain the lossy hidden-manager budget fallback\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals and restores authoritative host scrollback\",\n            \"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output\",\n            \"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport\",\n            \"client recovery completes while every target terminal remains unmounted in the host renderer\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals against an isolated headless Orca host\",\n            \"cold-activates only visible paired terminals against an isolated headless host\",\n            \"the headless host bounds real-PTY decorative title transport and production store application\",\n            \"the headless host shares the zero-hidden-renderer-work and exact-restoration contract\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-parked-memory.spec.ts\",\n          \"assertions\": [\n            \"releases un-parkable hidden worktree buffers only once the retention budget engages\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n          \"assertions\": [\n            \"admits 128 active streams, rejects the 129th, and reuses released capacity\",\n            \"reserves PTY wait capacity independently from active streams\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"pauses capable paired output while hidden and restores exactly on reveal\",\n            \"locally gates hidden paired output when a legacy host cannot pause it\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n          \"assertions\": [\n            \"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n          \"assertions\": [\n            \"keeps pairing while manual disconnect fences passive reconnects\",\n            \"returns a disconnect envelope when a queued active runtime call disconnects\",\n            \"returns a disconnect envelope when a queued selected environment call disconnects\"\n          ]\n        }\n      ]",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope. The ordinary paired-scroll-back alias was already absent before this batch and is removed as stale metadata, separately from the newly retired floating-pane example.",
        "Audit3053 reduces hidden-replay coverage by retiring nominal overlap, resize, cursor metadata and standalone stalled-restore variants. Timeout, overflow, identity/generation fences and retained live-output coordination remain; the removed alarms are intentionally lost without equivalent replacement. Existing commands, assertion references and dated evidence retain their original scope.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Paired reveal restores at most the requested 5,000 rows; older history is intentionally unavailable.",
        "The scaled paired scenarios use six worktrees and ordinary-park five; they prove real host-backed eviction and buffer release, not a 100-worktree soak.",
        "Display-off reveal latency is a separate atlas and viewport-reflow class and is not covered by this gate.",
        "Historical field trace archives are still required to order replay-wedge events against renderer heartbeat loss and deduplicate archived records.",
        "The legacy protocol shape is deterministic unit coverage; a packaged pre-v1.4.163 host has not yet run the full headed memory oracle.",
        "The live windows-issues incident recorded two fast snapshot-probe successes while fresh output remained stale, but that release did not log the returned snapshot sequence; the deterministic sequence-gap oracle matches the observed false-health boundary without proving the field transport's lower-level drop mechanism.",
        "The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage.",
        "The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage.",
        "Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed.",
        "Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/session-tabs-inventory-publication.test.ts src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts src/main/runtime/rpc/methods/session-tabs.test.ts src/main/daemon/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs-inventory-publication.test.ts src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts src/main/runtime/rpc/methods/session-tabs.test.ts src/main/daemon/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 10.35,\n          \"summary\": \"Test Files  5 passed (5); Tests  58 passed (58). Fixture correctness only; no timing, work-count or retained-heap conclusion.\"\n        }",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\"result\":\"passed\",\"durationSeconds\":39.74,\"summary\":\"Test Files  19 passed (19); Tests  1858 passed | 3 skipped (1861). Fixture correctness only; no timing, work-count or retained-heap conclusion.\"}",
        "Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.16,\n          \"summary\": \"All 27 encrypted shared-control tests passed. The new oracle was red on rc.1-equivalent behavior with the exact Refreshing remote runtime control transport error, then passed with one replacement connection, one delivered host RPC, and zero retained pending bytes.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\"\n        }",
        "Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required.",
        "Retired during audit1355 application of audit1346 at b176; complete original execution receipt unchanged, historical only:\n{\n          \"date\": \"2026-08-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.62,\n          \"summary\": \"Forty-two deterministic contracts passed. The real-PTY cross-boundary contract delivered all 2,880 decorative spinner and bare-native redraw chunks with zero hot-path host publications, serialized bytes, renderer applies, or store mutations; continued past 30 minutes with one globally spaced freshness refresh per worktree every 15 minutes; kept all 24 mirrored statuses working; and preserved stable stateStartedAt. Exact-identical Pi and rotating normalized Pi/Grok frames renewed renderer-authored and retained-hook status without changing acknowledgement semantics. Rich status could not cross task completion, permission, provider-generation, or identity-owner boundaries, while neutral titles preserved same-task prompt and acknowledgement identity until authoritative shell evidence. Fresh renderer, retained OSC, and live-hook questions remained visible under the current shell title, but a later working interval, identity-only owner title, or provider generation stripped them; inherited tools and stale, resume-only, restored, or prior-interval questions stayed suppressed. After each rich source's original lease expired, title evidence kept only coarse working state and provider identity fresh while dropping unverifiable prompts. Unknown foreground ownership held publications at zero until resolution, then resumed the bounded heartbeat; tracked terminal state reset removed its delayed marker. The focused heartbeat contracts proved worktree deduplication, FIFO fairness, semantic bypass, PTY-source teardown, and timer cleanup. Causal-disable controls made ownership, teardown, retained source-switch, renderer rich-TTL, completion-transition, boundary-ordering, and live-question oracles fail; restoring the production corrections returned green.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1\"\n        }",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"forwards facts over the shared client-event stream without a desktop renderer\",\"bounds decorative title delivery per paired client without reducing local frames\",\"prefers provider history over a partial headless mirror for requested snapshots\",\"falls back to the available mirror when authoritative provider history is unavailable\",\"bounds a hung authoritative provider acquisition and reuses its fallback\"]}]",
        "Audit1402: src/renderer/src/components/terminal-pane/pty-connection-park-reveal-model-snapshot.spec.ts reduced. Loses basic paired serialize/initial replay forwarding check; hidden alt-frame grid/precedence policy remains. No real terminal renderer claim. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1412: src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts reduced. Loses FIFO fairness/spacing, semantic bypass/cancellation, delayed-boundary scheduling and teardown timer-cleanup alarms. Retained fixed emission cases do not replace those outcomes. No equivalent replacement coverage is claimed.",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n          \"durationSeconds\": 9.95,\n          \"summary\": \"Test Files  3 passed (3); Tests  53 passed (53). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit1412 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n          \"durationSeconds\": 8.91,\n          \"summary\": \"Test Files  3 passed (3); Tests  53 passed (53). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit1412 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"paired-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1412 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n    \"assertions\": [\n      \"one globally spaced FIFO refreshes each continuously active worktree before status expiry\",\n      \"sibling PTYs deduplicate to one worktree refresh while semantic transitions bypass the queue\",\n      \"sole-source PTY teardown removes queued work while sibling PTY sources remain deduplicated\",\n      \"worktree, pending-queue, and timer state is removed on teardown\"\n    ]\n  }\n]",
        "Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. deletes src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx: Loses modeled React oscillation alarm; real pane/watchers are not exercised. deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1417 retires this complete dated receipt because its selector contains a deleted source. The shortened selector has no fresh result. Original receipt verbatim:\n{\n          \"date\": \"2026-08-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.56,\n          \"summary\": \"All 16 production-parity parking/watcher contracts passed on the combined candidate, covering the maximum-depth loop, semantic stability, StrictMode ownership, split-PTY reconciliation, and zero-park fast path.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\"\n        }",
        "Removed modeled cold-park work-count/memo-cache harness alarms have no equivalent replacement coverage.",
        "Audit1931 (sources1928/1929): Delete the complete hook-agent-status projection suite and its two behavioral assertion aliases. Supplied stored hook/title/resume/staleness/rename/question/generation/PTY-retirement/snapshot-version projections are intentionally lost. The separate osc-status-scan gate mentions this source only in existing historical notes and receives no mutation. No measured hidden-output retention, CPU/RSS or resource budget result is claimed by the deleted source or this audit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'ranks a completed hook below present launch evidence in terminal identity'; 'carries the hook state, tool and interactivePrompt to paired clients'; 'publishes a gated turn end as event metadata, not stored agent status'; 'publishes no hook transport identity to clients'; 'falls back to identity-only done once the hook row goes stale'; 'never fabricates live state from a %s resume row'; 'refuses a hydrated unconfirmed row as live while keeping its resume identity'; 'keeps a restored working turn unverifiable instead of done'; 'keeps a restored turn older than the live freshness window unverifiable'; 'lets a newer confirmed row supersede an old restored turn even once stale'; 'lets a shell title retire a restored turn to identity only'; 'projects the OSC turn that replaced the hook row in the store'; 'keeps a shell-reclaimed pane identity-only when the hook row has just a toolName'; 'keeps the hook transcript address after a manual rename drops the agent glyph'; 'keeps a live working hook after a manual rename'; 'keeps the terminal agent status running after the pane is renamed to a shell name'; 'retires the renamed agent when its OSC title returns to the shell'; 'does not invent a transcript address for a renamed shell pane'; 'still has no transcript address when a renamed pane never reported a session'; 'keeps a pending question visible even under a non-agent title'; 'does not carry a shell-obscured question into the next working interval'; 'does not carry a hook question across a provider generation reset'; 'evicts the predecessor row at a certified provider generation reset'; 'evicts a row joined only through the terminal handle on certified PTY exit'; 'evicts the central status row when a disconnected PTY record is pruned'; 'keeps an unverifiable remote row when its disconnected PTY record is pruned'; 'evicts a dismissed handle-joined remnant on certified PTY exit'; 'does not carry a hook question across an identity-only owner title'; 'keeps the title-derived working state when the hook row predates the title'; 'publishes a hook row received after the latest title observation'; 'bumps the snapshot version and emits through the coalescer'; 'ignores a pane with no resolvable workspace'; 'retires the question card after the pane status is cleared'; 'keeps a working hook when a preexisting idle interval repaints as %s'; 'keeps a real idle transition and later done hook authoritative after a working hook'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts\",\n          \"assertions\": [\n            \"a live pending question remains visible under the current live shell title but cannot cross a later working interval, identity-only owner title, or provider generation\",\n            \"inherited tool names, stale rows, resume-only rows, and unconfirmed restored rows cannot reopen a shell-reclaimed pane\"\n          ]\n        }",
        "Audit1939 (sources1934/1935): Delete the synthetic watcher-synchronization and partial-reconciliation suites. Retire all affected host-fact, capability-owner, activation-residue and retention-cap aliases because the remaining callbacks do not establish those full claims. Keep exact local hook/timer, byte-stream side effects, exit/disposal, scroll-intent cleanup and deterministic local rank/TTL progression callbacks within their mocked-host scope. No physical paired-host retention, resource budget or equivalent replacement evidence is assigned. The generic broad test command remains a runnable discovery command, never a dated execution receipt. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'reinstates parked watchers after StrictMode effect replay cleanup'; 'resynchronizes a parked split when only its detached PTY and layout change'; 'does not scan unparked worktrees on an unrelated store write'; 'does not resynchronize when nothing the key covers changed'; 'resynchronizes when %s changes'; 'resynchronizes when a caller-supplied key or tab set changes'; 'keeps adjacent key fragments from borrowing each other characters'; 'parks paired-runtime tabs only when their exact host advertises restore'; 'skips parking scans for capability-equivalent status writes and scans membership changes'; 'keeps eviction-exempt tabs mounted when the worktree is force-parked'; 'resolves eviction exemptions once per force-park input change'; 'does not exempt a tab from a truncated malformed pane key'; 'does not drive the tab title when drivesTabTitle is false'; 'forwards completion to notification policy when only terminal attention is on'; 'keeps mobile completion detection active when desktop notifications and attention are off'; 'never writes a color-scheme reply for a DECSET 2031 subscribe'; 'scans OSC 133;D bytes into the parked command policy and disposes it with the watcher'; 'feeds Command Code output through the parked byte detector'; 'leaves the scrape unarmed when the parked pane has no in-flight Command Code turn'; 'clears the watcher-written runtime title slot on dispose'; 'leaves the runtime title slot alone on dispose when it never wrote one'; 'dispose drops the processor from the pty side-effect census'; 'consumes host facts without a raw terminal stream for paired PTYs'; 'does not consume bytes: a byte BEL produces no unread or notification'; 'routes command lifecycle facts into the parked command policy'; 'ignores replayed command lifecycle facts (no-attention-replay rule)'; 'does not request a title snapshot for an ordinary parked watcher'; 'applies bell facts with the byte-mode policy: unread now, OS notification delayed'; 'fires the cache timer and completion from working→idle facts'; 'replay batches restore the title only — attention facts never replay'; 'stays silent on a main 2031-subscribe fact'; 'marks the PTY hidden for delivery on start and clears it on dispose'; 'sets no hidden bit and stays silent on 2031 when the gate kill switch is off'; 'observes PR links from pr-link facts with worktree attribution'; 'produces identical store outcomes via the channel as the byte parser did'; 'never starts a watcher for a PTY that exited into the park handoff gap'; 'collapses the exited leaf out of the stored layout when deferring'; 'retires launch/title hints when the launch-owning parked leaf exits'; 'keeps launch ownership when only a parked shell sibling exits'; 'rejects ordinary parking for a preserved daemon with a lossy snapshot'; 'rejects a capture containing a PTY without snapshot backing'; 'accepts layout-derived candidates when the capture is stale'; 'rejects layout-derived candidates missing a leaf PTY binding'; 'retains a continuing watcher and title while reconciling a reminted split leaf'; 'prefers an authoritative inactive split-leaf remint over the unmount capture'; 'drops the fact when the leaf re-minted a different PTY'; 'selects only reachable hosts advertising the paired parking contract'; 'shares the capability Set across status-only changes and replaces it on membership changes'; 'allows local daemon sessions owned by the worktree'; 'allows folder-workspace sessions owned by the workspace'; 'rejects separator-less local PTY ids that lack a daemon session model'; 'rejects tabs that do not have a PTY yet'; 'rejects daemon sessions owned by another worktree'; 'rejects SSH and remote runtime PTY handles'; 'accepts every snapshot-backed pty regardless of policy'; 'accepts SSH ptys only when the SSH-parking policy is enabled'; 'accepts paired ptys only for the exact snapshot-capable owner'; 'rejects paired, fail-open, foreign, and null ptys without capability evidence'; 'parks hidden local terminal renderers after the idle delay'; 'parks a hidden SSH worktree only under the SSH restore policy'; 'defers preserved-daemon snapshot authority to the watcher coverage gate'; 'never parks when the settings kill switch disables parking'; 'keeps renderers mounted while visible, measuring, portaled, or before the delay'; 'honors a per-call cold-park delay override'; 'holds an otherwise past-deadline candidate out of park until the measure cool-down ends'; 'keeps the renderer mounted when any terminal lacks snapshot-backed restore'; 'keeps renderers mounted while a tab has startup or activation work pending'; 'ignores mirrored activation residue after a capable paired PTY exists'; 'parks an idle hidden local tab and honors the kill switch'; 'ignores mirrored activation residue after a capable paired PTY exists'; 'honors a per-call cold-park delay override'; 'holds an otherwise past-deadline tab out of park until the measure cool-down ends'; 'keeps recent hidden local worktrees hot up to the retain limit'; 'selects nothing when the settings kill switch disables parking'; 'does not cold-park terminals without local snapshot recovery'; 'keeps visible, measuring, portaled, and pending terminals mounted'; 'keeps visible and recent inactive terminal tabs mounted'; 'cold-parks the oldest inactive local tabs beyond the retain limit'; 'selects nothing while the post-measure cool-down is active'; 'cold-parks aged inactive local tabs even when under the retain limit'; 'never cold-parks the single most-recently-hidden (last-active) tab'; 'selects nothing when the settings kill switch disables parking'; 'does not cold-park inactive terminal tabs without local snapshot recovery'; 'keeps portaled, pending-startup, and pending-activation terminal tabs mounted'; 'keeps the parking dependency stable for a title-only change across 300 worktrees'; 'changes for %s'; 'changes for add, remove, and move transitions'; 'treats a host-backed paired PTY as settled despite activation residue'; 'preserves real startup work and non-paired activation guards'; 'exempts only live local ptys a remount could not reattach'; 'never exempts authoritative, SSH, remote-runtime, or unbound ptys'; 'exempts a preserved daemon without an authoritative snapshot'; 'returns empty when either kill switch is off'; 'force-parks the least-recently-hidden candidates beyond the retention limit'; 'force-parks past the TTL even under the limit, sparing a last-active candidate inside it'; 'never force-parks visible, measuring, portaled, covered, pending, or fresh candidates'; 'holds a candidate out of force-park until its post-measure cool-down ends'; 'is idempotent and only grows as time advances (flip-loop dwell)'; 'drops eviction-exempt tabs from the capture and unmount set'; 'yields nothing when every tab is exempt'.",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-parked-terminal-watcher-synchronization.react185.test.tsx\",\n          \"assertions\": [\n            \"StrictMode cleanup replay restores watcher ownership\",\n            \"detached split-PTY and layout replacement reconciles\",\n            \"unparked unrelated writes perform zero PTY-map reads\"\n          ]\n        }",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/output-watchers/parked-terminal-byte-watcher.test.ts\",\n          \"assertions\": [\"consumes host facts without a raw terminal stream for paired PTYs\"]\n        }",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n          \"assertions\": [\"starts a fact watcher for snapshot-capable paired PTYs\"]\n        }",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-partial-reconciliation.test.ts\",\n          \"assertions\": [\n            \"retains a continuing watcher and title while reconciling a reminted split leaf\"\n          ]\n        }",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n          \"assertions\": [\n            \"selects only reachable hosts advertising the paired parking contract\",\n            \"accepts paired ptys only for the exact snapshot-capable owner\",\n            \"rejects paired, fail-open, foreign, and null ptys without capability evidence\"\n          ]\n        }",
        "Audit1939 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n          \"assertions\": [\n            \"treats a host-backed paired PTY as settled despite activation residue\",\n            \"preserves real startup work and non-paired activation guards\",\n            \"force-parks the least-recently-hidden candidates beyond the retention limit\"\n          ]\n        }",
        "Audit1983: Remove the reasonless-close selector and narrow census aliases to actual retained runtime and injected-inventory callbacks. The removed synthetic census-dedup and isolated pre-boundary timing cases receive no replacement credit; preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs-inventory-publication.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/session-tabs/session-tabs.test.ts\"",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n          \"assertions\": [\n            \"pre-boundary creation and removal are subsumed by the census exactly once\",\n            \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n            \"create/remove/recreate transitions are preserved without collapse\",\n            \"projected PTY state already visible in the census is deduplicated while later projected state is delivered\",\n            \"coalesced delivery uses its scheduling watermark across every subscriber\",\n            \"initialization churn is memory-bounded and repeated structural overflow fails after bounded recollection\",\n            \"initialization clears buffered transitions on cancellation\"\n          ]\n        }",
        "Audit1991: Remove initial-snapshot sequence-domain, limited-tail/truncation and unknown-output-sequence aliases whose callbacks are removed. The source retains partial-chunk replay and requested-snapshot retry/admission at supplied snapshot/data seams, not equivalent replacement or measured retained-memory proof. Preserve the existing stream/pending-wait capacity aliases only to their retained owning multiplex callbacks with supplied PTY resolutions. Removing the sibling-PTY heartbeat dedup work-count sample does not establish a new decorative fanout budget; the unrelated-PTY cancellation fence survives. Preserve17 unrelated dated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n          \"assertions\": [\"keeps layout versions out of the output sequence domain\"]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n          \"assertions\": [\n            \"binary first paint remains valid when only retained history was truncated\"\n          ]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n          \"assertions\": [\n            \"omits an unknown snapshot output sequence instead of publishing the layout version\"\n          ]\n        }",
        "Audit2003: Remove SSH/absent-inventory attach refusal, later-subscriber retry, no-view adoption/takeback, provider-tail/unknown-read projections, failed-keystroke retry and simpler loss reattach examples. Keep the existing-subscriber inventory-ready retry alias only at its retained callback, plus retained held-input cancellation/replacement and overlapping attach/loss fences. The inventory driver also loses the whole empty-worktree-publication registration and folder-host/unverifiable scalar examples. Retire the entire dated10-case attach receipt; retain16 independent receipts only in their original scopes. No retained-memory or real-daemon measurement follows from supplied provider inventories. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.29,\n          \"summary\": \"All 10 subscriber-driven attach contracts passed. With two authoritative inventories overlapping one refused in-flight attach, removing only the post-settlement retry made the byte-identical focused assertion fail with one attach instead of two; restoring it retained one bounded waiter, retried once, and resumed live output on the existing stream.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts\"\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit2162: Intentionally remove the initial empty headless publication and pre-cancelled no-scan-count callbacks from src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts. Keep the exact renderer publication/reload/resync/cancelled-reload/promotion-failure/cancellation/unauthorized-publisher callbacks. Existing commands and assertionRefs remain within their own scopes; no equivalent replacement for removed examples is claimed. All dated evidenceRuns and redGreenEvidence remain verbatim and do not validate changed source bytes. No fresh gate execution, real daemon/provider, rendered, remote/mobile, cross-platform or measured-budget result is claimed.",
        "Audit2377/2381 removes bundled-skill eligibility5 silent late-writer successful backup, layouts1 global forced backup, legacy-auto-update2 old release plus extra notes, and native-discovery7/13/18/19/21 OpenCode project, Pi home symlink, default Hermes root, requested-cwd agents symlink and standalone SSH-builder paired cwd checks. Lose those exact backupPath/bytes/global-link-lock/history/provider/label/path combinations and localized SSH-builder sample. Retained common owners are not identical replacements; no fresh validation is claimed for this reduced broad command.",
        "Audit2383 removes the complete antigravity-skill-discovery.test.ts suite. Lose the exact .gemini/config/skills path, home-antigravity source, antigravity owner, existence and contributing-root observation. Other providers exercise common discovery dispatch, not this exact catalogue row. No equivalent replacement or fresh validation of the reduced broad command is claimed.",
        "Audit2385 removes finder regular-depth and direct missing-root examples, the three-row staging-name matrix, and an initial unknown WSL-list record sample. Lose those isolated fixtures, exact backup name spellings and malformed prefix sequence; retained actual owners are not identical replacements. Missing-root case did not model disappearance after the production caller existence check. No fresh validation of this reduced broad command is claimed.",
        "Audit2389 removes whole skill-install-preview.test.ts plus destinations1 and recovery2. Lose missing-preview name/state/global identity/fixed codex+claude inventory, exact plain-global host identity return, and already-published receipt finalization fixture. No nonmutation assertion existed in preview; retained real home delivery and placed-canonical recovery are not identical complete replacements. No fresh validation is claimed.",
        "Audit2393 refresh2401 removes skill-installation original1 and only the original receiptless request case. Lose uninterrupted first-install status/exact placement count and public canonical receiptless conflict/unowned routing. Retain upstream request ownership tests and lower transaction interruption coverage byte-exact. Deleted guard case had no directory/content preservation assertion. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2397 review amendment removes whole empty-gzip, WSL provider error-mapping and remote-cancellation registry suites; two initial hostname-suffix/userinfo URL rows and initial-expired grant sample; linked-parent alias classification. Lose no-input custom gzip branch, WSL failure labels, basic registry lifecycle/duplicate-ID guard, exact hostname-suffix/userinfo input variants, prefetch expired-grant no-network and preexisting alias result alarms. Preserve the single initial wrong-port origin authorization case, original abort-after-begin cleanup/no-signal cancelUpload dispatch suite and original independent-copy modified-digest removable=false case. No equivalent complete replacement or fresh validation claimed for the remaining losses.",
        "Audit2404 removes whole skill-share-package-name.test.ts, skill-delete-plan original1/6 skill-delete-recovery original2 and skill-share-preparation original2. Lose lookup503 rejection/status propagation through prepare, explicit unblocked unordered alias-kind/canonical sample with cwd undefined, stale classification after +60000ms actual mtime change, successful first-pass single-move rollback/staged-path absence and prior-process preparation-root archive directory cleanup. Retained exact identities use cwd home; public stale guard submits timestamp1; recovery retry cases are not identical first-pass fixtures. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2412 removes whole useVirtualizedScrollAnchor.marks-restore-signal.test.ts (six fake-hook geometry/mark/convergence/user-takeover/clamp alarms), use-task-creation-draft-retention original3/4 (immediate discard mock-call count/unopened no-write), use-terminal-bulk-close-actions.placement original6/7 (absent new-agent append and one real history-publication count at consumed3/30 scale), PendingNativeChatCreation original6 (unmounted abort completion/timer cleanup), and wsl-move-dialog-store original1/9/13 (default whole-distro count/reference/reuse and rejected-preview/start refusal recovery). The history counter measures genuine publication work without entries/order/reopen assertions; its unique batching alarm is intentionally retired. Fake React scroll tests ignore dependency scheduling and cleanup; unique simulated arithmetic alarms are deliberately lost. Retained existing-terminal reorder is not new-agent append coverage; mounted handoff timeout is not abort coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2417 removes commit-actions-real-git original3/4 (ordinary clean cherry-pick and revert content, subject and current-branch samples), and pty-startup-ingress-exited-asker original8/12 (actual foreground-group read budget across100queued queries, and zero foreground reads across100normal chunks plus final emitted/accepted raw cursor equality). Counters measure actual callback work and scale is consumed; these internal-work alarms are deliberately retired. Retained unborn, conflict and sequencer cases are not equivalent ordinary-success coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2425 removes use-workspace-copy-status original5, which returns a fixture-supplied readError string through statusReadError. No consumer blocker or attempted branch switch established refusal; the unique error-forwarding sample is intentionally retired. Other copy ownership and stale-refresh cases are not equivalent error-path coverage. No equivalent replacement or fresh validation is claimed.",
        "Audit2432 removes BranchPicker.test.tsx original3, which only asserted onOpenChange(true/false) with an always-mounted mocked Popover. It never reopened the picker or consumed the callback in the parent status-refresh owner, despite its title. Lose that unique open/close notification alarm. Retained blocker/collision recovery and asynchronous post-unmount outcome cases are not equivalent replacement coverage. No fresh validation of the reduced selector is claimed.",
        "Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. The direct side-effect-facts selector retains six cases: replay exclusion, live sequence handling, stale disposer ownership, one handoff drain, drain-before-snapshot, and stale replacement-snapshot refusal. Successful current-entry snapshot application is not witnessed by the retained snapshot case.",
        "Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed.",
        "Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed.",
        "Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed.",
        "Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation.",
        "Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed.",
        "Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked.",
        "Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed.",
        "Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms.",
        "Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery.",
        "Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction.",
        "Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed.",
        "Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed.",
        "Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed.",
        "Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed.",
        "Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed.",
        "Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired.",
        "Terminal/runtime defining-owner cleanup retires complete parking timer, lifecycle, mocked close/disposal and render/flip/mount work-count cases under repository test policy. The retained watcher source has only two literal-oracle coverage decisions; the retained cold-parking hook source has only the layout-PTY exemption invalidation case. Lost alarms include cooldown/measure/pin wakeups, split exit/close attribution and cancellation, watcher disposal/restart, flood timer rearm, worktree verdict damping, and destroyed-transport cold restore. No equivalent replacement coverage or execution pass for the reduced cases is claimed; prior dated receipts retain their original scope.",
        "Module-layout wave3 intentionally retires complete prohibited owning registrations in src/renderer/src/components/terminal-pane/parking/output-watchers/parked-terminal-byte-watcher.test.ts. Lost alarms: Loss of the OSC title forwarding/order alarm for both pane and tab titles. Loss of the bare Cursor Agent title versus synthetic spinner title/deduplication alarm. Loss of the unread BEL attribution and delayed OS bell notification alarm. Loss of the OSC-terminator BEL exclusion alarm across chunk boundaries. Loss of the working-to-idle prompt-cache and completion-notification alarm. Loss of the same-burst completion-over-bell coalescing alarm. Loss of the resumed-working cancellation of pending completion and cache timer alarm. Loss of the cross-chunk GitHub pull-request discovery and workspace/pane attribution alarm. Loss of the Command Code return-to-done callback wiring alarm; real composer delivery was not established. Loss of the already-in-flight Command Code scrape/return alarm. Loss of the park-time working seed to idle completion alarm. Loss of the no-unobserved-transition completion alarm. Loss of the shutdown cancellation and final-flush attention-suppression alarm. Loss of the sidecar unregistration and pending-bell cancellation alarm. Loss of the same-PTY previous-watcher disposal alarm. Loss of the cold snapshot title restoration without replayed attention alarm. Loss of the stale-derived idle fact state-clear/no-completion alarm. Loss of the fact-consumer disposal and written title-slot clearing alarm. No equivalent replacement coverage or reduced-selector pass is claimed.",
        "Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands.",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical.",
        "Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed.",
        "Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed.",
        "Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed.",
        "Audit 3318 reduces remote-runtime-pty-transport-unpublished-host-graph.test.ts, retiring its direct published-empty-graph omission-to-pane-exit alarm. The unchanged bounded unpublished-frame/pushed-recovery and stale-handle park/manual-retry cases are narrower, not equivalent replacements. Both complete three-case Linux receipts dated 2026-11-04 are archived as historical, including source heads; they do not validate this reduced selector. Remaining fourteen active receipts are macOS only. No fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit 3318 retires this complete dated three-case Linux unit receipt because remote-runtime-pty-transport-unpublished-host-graph.test.ts was reduced. Original command/currentCommand/result/date/duration/source head/count remain historical and do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-unpublished-host-graph.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n          \"durationSeconds\": 3.87,\n          \"summary\": \"Test Files  1 passed (1); Tests  3 passed (3). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n        }",
        "Audit 3318 retires this complete dated three-case Linux unit receipt because remote-runtime-pty-transport-unpublished-host-graph.test.ts was reduced. Original command/currentCommand/result/date/duration/source head/count remain historical and do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-unpublished-host-graph.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n          \"durationSeconds\": 3.79,\n          \"summary\": \"Test Files  1 passed (1); Tests  3 passed (3). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n        }",
        "Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: restarts only the stream whose renderer delivery credit never settles — An unreturned renderer delivery credit stalls only its stream, leaving healthy sibling/shared transport alive. Fake-clock deadline plus real multiplexer unsubscribe isolates recovery ownership.; probes then restarts a stream when an entered command receives no frames — Entered command produces no output; actual multiplexer must probe then close only its stalled stream after probe timeout. Distinct response liveness from parser credit.; establishes a probe baseline before recovering an unsequenced stream — 142-line manual five-probe baseline/regression sequence derives request IDs from encoded mock traffic and checks repeated no-close/close choreography. Oversized algorithm/state-machine example; no actual renderer/host command or recovery delivery. Retires unsequenced/unchanged/regressed baseline classification alarms.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts, src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n        \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n        \"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n        \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n        \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts\",\n        \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts\",\n        \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-watcher-reconciliation.test.ts\",\n        \"src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts\",\n        \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/terminal-parked-memory.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts\",\n        \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n          \"assertions\": [\n            \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n            \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n            \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n            \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n            \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n            \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n            \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n            \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n            \"tracked terminal state reset clears delayed foreground ownership markers\",\n            \"raw chunks, semantic idle transitions, and visible output remain exact\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n          \"assertions\": [\"retries an existing subscriber when provider inventory becomes ready\"]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n          \"assertions\": [\n            \"creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed\",\n            \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n            \"create/remove/recreate transitions are preserved without collapse\",\n            \"a post-boundary projected-state change is delivered without a new snapshot revision\",\n            \"an older coalesced callback cannot overwrite a newer immediate change\",\n            \"initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection\",\n            \"disconnect aborts the census and removes the real runtime listener\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n          \"assertions\": [\n            \"unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer\",\n            \"an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes\",\n            \"re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n          \"assertions\": [\n            \"preserves daemon PID and target PTY identity across the paired host relaunch\",\n            \"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation\",\n            \"delivers target and post-relaunch control terminal input and live output\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n          \"assertions\": [\"replaces a stale paired stream when the PTY snapshot advanced\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\n            \"restarts one ACK-starved paired terminal stream without replacing its PTY\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\"recovers an ACK-starved stream from an isolated headless Orca host\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n          \"assertions\": [\n            \"a nonempty lossy initial snapshot paints exactly once on a paired client\",\n            \"the authoritative host cursor advances and live output resumes exactly once\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n          \"assertions\": [\n            \"paints a paired remote terminal when only its retained text tail overflowed\",\n            \"legacy paired hosts retain the lossy hidden-manager budget fallback\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals and restores authoritative host scrollback\",\n            \"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output\",\n            \"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport\",\n            \"client recovery completes while every target terminal remains unmounted in the host renderer\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals against an isolated headless Orca host\",\n            \"cold-activates only visible paired terminals against an isolated headless host\",\n            \"the headless host bounds real-PTY decorative title transport and production store application\",\n            \"the headless host shares the zero-hidden-renderer-work and exact-restoration contract\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-parked-memory.spec.ts\",\n          \"assertions\": [\n            \"releases un-parkable hidden worktree buffers only once the retention budget engages\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n          \"assertions\": [\n            \"admits 128 active streams, rejects the 129th, and reuses released capacity\",\n            \"reserves PTY wait capacity independently from active streams\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"pauses capable paired output while hidden and restores exactly on reveal\",\n            \"locally gates hidden paired output when a legacy host cannot pause it\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n          \"assertions\": [\n            \"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/hosted-terminals/streams/remote-runtime-terminal-stall-recovery.test.ts\",\n          \"assertions\": [\n            \"keeps the oldest pending delivery deadline anchored while later frames settle\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n          \"assertions\": [\n            \"keeps pairing while manual disconnect fences passive reconnects\",\n            \"returns a disconnect envelope when a queued active runtime call disconnects\",\n            \"returns a disconnect envelope when a queued selected environment call disconnects\"\n          ]\n        }\n      ]",
        "Audit3342 removes three supplied activation/inventory fallback and same-handle retry examples; their fallback/retry alarms are intentionally lost without equivalent replacement. The exact mounted-HUB pending old-stream-end versus replacement-snapshot registration and its assertion remain. Unrelated dated macOS receipts retain only their original scope; no fresh runtime, provider, performance, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts --maxWorkers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/runtime/session-lifecycle/publication/mobile-session-tabs-agent-status-heartbeat.test.ts\",\n        \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n        \"src/main/ipc/runtime-environments/runtime-environments-pairing.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n        \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n        \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n        \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n        \"src/main/runtime/session-tabs/runtime-inventory-publication-authority.test.ts\",\n        \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-agent-session.test.ts\",\n        \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/output/terminal-side-effect-facts-handler.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-visibility-and-exit.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-worktree-retention.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts\",\n        \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n        \"tests/e2e/terminal-parked-memory.spec.ts\",\n        \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-unpublished-host-graph.test.ts\",\n        \"tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts\",\n        \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n        \"tests/e2e/paired-client-first-terminal-unopened-host-worktree.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n          \"assertions\": [\n            \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n            \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n            \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n            \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n            \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n            \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n            \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n            \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n            \"tracked terminal state reset clears delayed foreground ownership markers\",\n            \"raw chunks, semantic idle transitions, and visible output remain exact\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/adoption/terminal-subscriber-driven-daemon-attach.test.ts\",\n          \"assertions\": [\"retries an existing subscriber when provider inventory becomes ready\"]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/session-tabs/session-tabs-inventory-census-race.test.ts\",\n          \"assertions\": [\n            \"creation and removal at the census release edge are subsumed once, and a delayed pre-boundary change is not replayed\",\n            \"post-boundary creation and removal replay after the initial snapshot in sequence order\",\n            \"create/remove/recreate transitions are preserved without collapse\",\n            \"a post-boundary projected-state change is delivered without a new snapshot revision\",\n            \"an older coalesced callback cannot overwrite a newer immediate change\",\n            \"initialization churn publishes only the latest projected state and repeated structural overflow fails after bounded recollection\",\n            \"disconnect aborts the census and removes the real runtime listener\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts\",\n          \"assertions\": [\n            \"unpublished empty inventory keeps resume dispatch at zero with the original daemon session, process id, and writer as the sole live writer\",\n            \"an authoritative empty inventory settles the mirror and releases exactly one resume dispatch with zero liveness probes\",\n            \"re-enabling unconditional empty hydration makes the identical oracle red with one resume dispatch, two session ids, two process ids, and two writer calls\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts\",\n          \"assertions\": [\n            \"preserves daemon PID and target PTY identity across the paired host relaunch\",\n            \"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation\",\n            \"delivers target and post-relaunch control terminal input and live output\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts\",\n          \"assertions\": [\"replaces a stale paired stream when the PTY snapshot advanced\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\n            \"restarts one ACK-starved paired terminal stream without replacing its PTY\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts\",\n          \"assertions\": [\"recovers an ACK-starved stream from an isolated headless Orca host\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-lossy-initial-snapshot.spec.ts\",\n          \"assertions\": [\n            \"a nonempty lossy initial snapshot paints exactly once on a paired client\",\n            \"the authoritative host cursor advances and live output resumes exactly once\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts\",\n          \"assertions\": [\n            \"paints a paired remote terminal when only its retained text tail overflowed\",\n            \"legacy paired hosts retain the lossy hidden-manager budget fallback\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals and restores authoritative host scrollback\",\n            \"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output\",\n            \"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport\",\n            \"client recovery completes while every target terminal remains unmounted in the host renderer\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts\",\n          \"assertions\": [\n            \"ordinary-parks paired terminals against an isolated headless Orca host\",\n            \"cold-activates only visible paired terminals against an isolated headless host\",\n            \"the headless host bounds real-PTY decorative title transport and production store application\",\n            \"the headless host shares the zero-hidden-renderer-work and exact-restoration contract\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-parked-memory.spec.ts\",\n          \"assertions\": [\n            \"releases un-parkable hidden worktree buffers only once the retention budget engages\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n          \"assertions\": [\n            \"admits 128 active streams, rejects the 129th, and reuses released capacity\",\n            \"reserves PTY wait capacity independently from active streams\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"pauses capable paired output while hidden and restores exactly on reveal\",\n            \"locally gates hidden paired output when a legacy host cannot pause it\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-activation-inventory-fallback.test.ts\",\n          \"assertions\": [\n            \"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/web/web-preload-api-runtime-environment.test.ts\",\n          \"assertions\": [\n            \"keeps pairing while manual disconnect fences passive reconnects\",\n            \"returns a disconnect envelope when a queued active runtime call disconnects\",\n            \"returns a disconnect envelope when a queued selected environment call disconnects\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. The decorative fanout suite retains only real OSC9999 ingestion through runtime/title heartbeat/viewer past the stale boundary, preserving stateStartedAt and clearing expired prompt metadata. Spinner volume/zero-work inventories, Pi/Grok frame tables, rich-status and foreground-reset examples are retired. Existing receipts for separate paired-terminal sources retain their original scopes.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3446 archived original assertionRef after source reduction; historical scope only, raw original object follows:\n{\n          \"file\": \"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts\",\n          \"assertions\": [\n            \"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence\",\n            \"the viewer performs zero snapshot applies and zero store mutations during decorative activity\",\n            \"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh\",\n            \"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics\",\n            \"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires\",\n            \"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity\",\n            \"ordinary-shell title transitions replace working stateStartedAt with the completion transition time\",\n            \"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval\",\n            \"tracked terminal state reset clears delayed foreground ownership markers\",\n            \"raw chunks, semantic idle transitions, and visible output remain exact\"\n          ]\n        }"
      ],
      "demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event or session-tabs publication volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes."
    },
    {
      "id": "terminal-performance.no-hot-list-sessions",
      "title": "Hot terminal interactions do not call global PTY session listing",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-performance",
      "layer": "ipc-count-contract",
      "surfaces": [
        "typing",
        "focus",
        "tab switch",
        "workspace switch",
        "visibility resume",
        "resize",
        "render"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1602 removes mocked transport, deletion and ownership inventories, provider metadata projections, private callback and counter checks, and duplicate reader examples without equivalent replacement coverage. Retained tests exercise SQLite/FTS migrations, transcript/cache/sidecar changes, recovery and cursor boundaries, local process/WAL/lock/framing and generated scripts. Remote and WSL failures and some delivery races remain injected; in-process reopen does not prove crash recovery, and counters do not prove latency or memory bounds. Historical scope before this audit: Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Platform-neutral unit coverage proves the Resource Manager closed badge performs one readiness seed, coalesces unknown spawn signals, skips known-session reattach signals, installs no interval, and re-reads only once per explicit daemon-management kill/restart. AI Vault tab-title sync uses bounded exact identities on the transcript-owning local, SSH, or runtime host and has no access to broad listing; unsupported older hosts retain persisted titles without fallback scans. WSL path translation still needs a Windows integration oracle. Audit1301: src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx removed. Visibility epochs, event identity fencing, retry and no-polling hook-layer alarms disappear. src/renderer/src/components/status-bar/resource-session-inventory.test.ts reduced. Detached-array/count/noop contracts, authoritative refresh variants, batching cadence, duplicate acknowledgements, error/pause combinations and other identity matrices lose their authored alarms. No equivalent replacement coverage is claimed. Audit1302: src/main/ai-vault/parse-cache/session-parse-cache-persistence.test.ts: Keep real filesystem/SQLite persistence, reopen/restart hits, changed-file invalidation, legacy/corrupt-cache recovery, concurrent scope replacement and optional-cache write failure isolation. Remove configuration/sidecar copy inventories, write-call-only timing/row counts, a wall-clock polling case with an internally hung parser, synthetic UNC aging/stat inventory and a no-op mock pretending to be failed database deletion. Lose these private configuration/scheduling/sidecar/UNC/fault wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7002",
        "https://github.com/stablyai/orca/pull/6858",
        "https://github.com/stablyai/orca/issues/9386",
        "https://github.com/stablyai/orca/pull/9387",
        "https://github.com/stablyai/orca/pull/12778"
      ],
      "invariant": "Typing, focus, terminal switch, workspace switch, visibility resume, resize, render, per-pane liveness, and tab-title synchronization must not call global pty:listSessions or aiVault.listSessions; they must use targeted APIs or cached provider-owned state.",
      "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The current executable slice asserts targeted visibility/first-input liveness, resize re-assertion after visibility resume, light tab/active-state resume, SSH/remote skip behavior, and a closed Resource Manager budget of one readiness seed plus one coalesced inventory read only for unknown spawn IDs. AI Vault title sync deterministically accepts only resolveSessionTitles, batches at most 64 exact identities, bounds scanner-service calls at sixteen, routes requests to the transcript-owning local/SSH/runtime host, and proves zero broad scans for unsupported hosts. The full hot-path oracle still needs instrumentation around raw focus, split focus, workspace switch, render ticks, and high-session PTY fixtures.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1301; any retained unchanged-source receipts apply only to their own commands. Historical account: Focused count tests now run locally; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1301 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Tests assert visibility resume prefers targeted hasPty over listSessions, first input after visibility resume calls targeted hasPty once, resize re-assertion after visibility resume uses getSize/resize without listSessions, light tab switches and visible active-state resume avoid listSessions/hasPty/getSize fanout, and the closed Resource Manager performs one readiness seed while known reattach signals and steady time perform no additional reads. For the #12778 regression, title sync no longer receives a listSessions dependency at all: it sends at most 64 exact identities per batch to the local scanner service or transcript-owning remote host, and old hosts degrade without broad fallback. Needs broader raw focus/workspace-switch/render/high-session PTY count coverage before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. This gate is the performance budget for global session listing in hot paths. AI Vault title sync permits zero global scans, at most 64 exact identities per request, one active scanner-service call per lane (cache, interactive), 16 active plus queued calls, four concurrent transcript parses inside the service, a 4,096-title index, and no worktree-path-triggered refresh. The service emits the aiVault.scan.service span with duration and session count for full scans."
      },
      "promotionCriteria": [
        "Add deterministic call-count instrumentation.",
        "Cover typing, focus, switch, visibility resume, resize, and render separately.",
        "Run with enough preserved sessions/providers to make a broad listing observable."
      ],
      "knownGaps": [
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1630 removes low-value Git, GitHub/GitLab and IPC projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1602 removes mocked transport, deletion and ownership inventories, provider metadata projections, private callback and counter checks, and duplicate reader examples without equivalent replacement coverage. Retained tests exercise SQLite/FTS migrations, transcript/cache/sidecar changes, recovery and cursor boundaries, local process/WAL/lock/framing and generated scripts. Remote and WSL failures and some delivery races remain injected; in-process reopen does not prove crash recovery, and counters do not prove latency or memory bounds.",
        "Current commands cover Resource Manager readiness/lifecycle inventory counts; the broader targeted-liveness slice still lives on the pending fix-terminal-reliability stack.",
        "Current coverage includes the closed Resource Manager's no-interval and known-reattach budgets, but not every hot interaction listed in the invariant.",
        "No Electron or IPC-level high-session counter gate yet proves raw focus, workspace switch, render, or high-session typing stay at zero PTY listSessions calls.",
        "The exact-title path has deterministic provider routing coverage but no packaged Windows WSL or live SSH performance run yet.",
        "Audit1301: src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx removed. Visibility epochs, event identity fencing, retry and no-polling hook-layer alarms disappear. src/renderer/src/components/status-bar/resource-session-inventory.test.ts reduced. Detached-array/count/noop contracts, authoritative refresh variants, batching cadence, duplicate acknowledgements, error/pause combinations and other identity matrices lose their authored alarms. No equivalent replacement coverage is claimed.",
        "Audit1301 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-06\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts --maxWorkers=2 --reporter=dot\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/pty-startup-barrier-and-listing.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts --maxWorkers=2 --reporter=dot\",\n          \"durationSeconds\": 8.736,\n          \"summary\": \"After removing source-text tests, the retained behavioral cohort passed 28 tests. No fresh native desktop, Docker, or hosted run is claimed. Historical evidence before the test removal (original commands were executed then, not rerun now): [{\\\"date\\\":\\\"2026-07-22\\\",\\\"runner\\\":\\\"local\\\",\\\"platform\\\":\\\"macos\\\",\\\"command\\\":\\\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/pty-startup-barrier-and-listing.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts\\\",\\\"result\\\":\\\"passed\\\",\\\"durationSeconds\\\":4.3,\\\"summary\\\":\\\"4 files and 358 tests passed, covering readiness seed/recovery, zero interval polling, bounded unknown-spawn reconciliation, concurrent provider starts, exit fencing, cleanup, and out-of-order refresh fencing.\\\"}]\"\n        }",
        "Audit1301 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx\",\n    \"assertions\": [\n      \"the false-to-true workspace readiness transition performs one daemon inventory seed\",\n      \"a failed readiness seed surfaces an error and a later inventory refresh recovers\",\n      \"known-session reattach signals perform zero additional inventory reads\",\n      \"multiple unknown background spawn signals coalesce to one inventory read\",\n      \"spawn signals during a slow inventory read never overlap provider-wide scans and cause at most one required follow-up\",\n      \"unknown sessions that exit before reconciliation cancel their queued inventory read\",\n      \"unmount during a slow inventory read cannot schedule follow-up work\",\n      \"exit and out-of-order refresh races cannot resurrect stale sessions\",\n      \"an explicit daemon-management invalidation performs exactly one inventory read, and none before readiness or after unmount\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/status-bar/resource-session-inventory.test.ts\",\n    \"assertions\": [\n      \"daemon inventory construction copies its source and preserves count parity\",\n      \"single and batch removals preserve unrelated sessions and no-op references\"\n    ]\n  }\n]",
        "Audit1302: src/main/ai-vault/parse-cache/session-parse-cache-persistence.test.ts: Keep real filesystem/SQLite persistence, reopen/restart hits, changed-file invalidation, legacy/corrupt-cache recovery, concurrent scope replacement and optional-cache write failure isolation. Remove configuration/sidecar copy inventories, write-call-only timing/row counts, a wall-clock polling case with an internally hung parser, synthetic UNC aging/stat inventory and a no-op mock pretending to be failed database deletion. Lose these private configuration/scheduling/sidecar/UNC/fault wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-02\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/main/ai-vault/session-scanner-service-client.test.ts src/main/ai-vault/session-title-file-reader.test.ts src/main/ai-vault/session-parse-cache-persistence.test.ts src/main/ipc/ai-vault.test.ts src/main/runtime/rpc/methods/ai-vault.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.3,\n          \"summary\": \"The focused run passed 138 tests across 7 files, proving exact-title-only renderer requests, provider-isolated batching, per-lane scanner-service lifecycle and fault recovery, exact transcript identity, host routing, mixed-version degradation, and zero broad-scan fallback.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/main/ai-vault/scan-service/session-scanner-service-client.test.ts src/main/ai-vault/session-titles/session-title-file-reader.test.ts src/main/ai-vault/parse-cache/session-parse-cache-persistence.test.ts src/main/ipc/ai-vault/ai-vault.test.ts src/main/runtime/rpc/methods/ai-vault.test.ts\"\n        }",
        "Renderer direct-owner cleanup retires the complete ai-vault-tab-title-sync suite (seven registrations), already referenced only by dormant historical metadata here. Its sleeping-title retention, kind normalization, late-host precedence, identity invalidation, wire serialization/concurrency, transcript-path retry and refresh-pacing alarms are lost without equivalent replacement. The retained freshness queued closed-tab case exercises public batch admission only and supplies no polling-budget, transport/provider/native UI or measured-performance result. No current gate evidence/selector is added; existing historical entries retain their original scope."
      ],
      "demotionRule": "Cannot promote if the test allows broad listing in any hot interaction path."
    },
    {
      "id": "terminal-observability.lifecycle-breadcrumbs",
      "title": "Terminal lifecycle anomalies enter crash diagnostics as compact breadcrumbs",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-observability",
      "surfaces": [
        "terminal lifecycle",
        "reattach",
        "restore",
        "replay-wedge identity",
        "provider ownership",
        "diagnostics bundle"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Retained renderer unit cases exercise guard release after a silent stalled parse and hardcoded breadcrumb event/pane identity with a fake terminal and mocked recorder. The identity-rich hashing/redaction registration was retired whole. No hashed tab/worktree/leaf identity, path-redaction, diagnostics-bundle export, live provider or packaged runtime coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6800",
        "https://github.com/stablyai/orca/issues/6773"
      ],
      "invariant": "Terminal lifecycle anomalies around reattach, restore, replay wedges, provider ownership, stale liveness, and fallback routing must leave compact, deduped, privacy-safe breadcrumbs in crash diagnostics so future reports can be attributed from evidence. Replay anomalies must distinguish pane managers and PTYs without recording path-bearing worktree or session identities.",
      "oracle": "Simulate replay and probe completions that never arrive, advance fake timers through both quiet windows, and require the real replay guard to transition from engaged to released while the mocked recorder receives terminal_replay_guard_wedged_release with paneId 1. This does not establish correlation hashing, path redaction or diagnostics-bundle export.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "renderer observability unit test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Retained selector has no CI soak history; fresh focused execution is recorded separately."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "No fresh revert/fault control was run for the retained selector. Historical richer-oracle statement before retirement is preserved in knownGaps and is not current reduced-selector evidence."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Replay identity hashing is synchronous and only runs when replay writes are queued; it adds no polling or provider calls. Breadcrumb storage remains bounded by the existing crash reporter. Full trace buffers must include size and event-count caps before promotion."
      },
      "promotionCriteria": [
        "Add full compact pane lifecycle trace buffer with event-count caps.",
        "Prove diagnostics bundle includes recent terminal lifecycle breadcrumbs or traces.",
        "Add forbidden-transition tests for stale close, unknown owner fallback, and stuck zero-size panes."
      ],
      "knownGaps": [
        "The replay identity schema has not yet been exercised in a live Electron/provider failure.",
        "Current coverage records anomaly breadcrumbs only, not a full pane lifecycle state-machine trace.",
        "Current coverage does not prove crash/diagnostics bundle export includes the breadcrumb.",
        "Current coverage does not assert forbidden transitions across live Electron/provider flows.",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts. Lost alarms: a wedged release hands the terminal to pane recovery; a healthy parse completion never notifies pane recovery; HOLDS the guard while a slow replay is still parsing — a probe is queued, never a blind release; records correlatable replay identity without exposing worktree or PTY paths; holds past the probe deadline while sibling completions prove the parser alive; settles guards on a disposed xterm without certifying a wedge. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope.",
        "Module-layout wave1 retires this complete historical receipt because its explicit current selector was reduced. It does not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-07-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/replay-guard.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.201,\n          \"summary\": \"The focused file passed 29 tests; replay anomaly breadcrumbs preserved event classification while adding hashed tab/worktree/leaf correlation and a path-redacted PTY identity.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts\"\n        }",
        "Module-layout wave1 historical richer-oracle metadata before identity-registration retirement, retained verbatim without current validation credit: {\"coverageNotes\":\"Renderer unit coverage proves replay-guard lost-completion and certified-wedge events carry correlatable tab, worktree, durable leaf, pane, and redacted PTY identity without exposing path-bearing values. Full provider lifecycle attribution and diagnostics-bundle artifact proof remain gaps.\",\"oracle\":\"Drop a replay write completion while allowing its FIFO probe to parse, then require the lost-completion breadcrumb to include pane ID, stable hashes for tab/worktree/leaf identity, and a path-redacted PTY ID. Existing wedge tests require both lost-completion and certified-dead paths to record their distinct event names. Full pane transition traces and diagnostics-bundle artifact proof remain follow-ups.\",\"redGreenEvidence\":{\"status\":\"partial\",\"evidence\":\"Tests fail if replay anomalies stop recording their event name, omit pane/terminal correlation, or expose the fixture's path-bearing worktree and PTY prefixes. Needs diagnostics-bundle artifact proof and full transition-trace evidence before promotion.\"}}",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts --maxWorkers=2\"\n      ]\ntestFiles: [\"src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts\"]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts\",\n          \"assertions\": [\n            \"releases after the probe itself never parses (wedged pipeline) and reports it\"\n          ]\n        }\n      ]\ncoveredPlatforms: [\"macos\"]\ncoveredProviders: []",
        "NEXT46 historical original evidenceRuns object (verbatim; no current-selector pass credit):\n{\n          \"date\": \"2026-11-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/snapshots/replay-guard.test.ts --maxWorkers=2\",\n          \"durationSeconds\": 1.52,\n          \"summary\": \"Retained replay-guard suite passed 19 cases on the module-layout wave1 candidate. The named breadcrumb case preserves real replay guard release and the hardcoded wedged event/pane1 with a fake terminal and mocked recorder. No identity-hash/redaction, live provider, diagnostics-bundle, fresh red/green, performance or CI-soak claim.\"\n        }"
      ],
      "demotionRule": "Cannot promote if diagnostics are console-only, unbounded, or missing from support artifacts."
    },
    {
      "id": "terminal-performance.output-backpressure-budget",
      "title": "Terminal output backpressure stays bounded from daemon to renderer",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-performance",
      "layer": "provider-ipc-renderer-perf",
      "surfaces": [
        "daemon stream",
        "main PTY batching",
        "runtime path provenance",
        "runtime terminal wait detection",
        "SSH relay frame decoding",
        "SSH PTY source retention",
        "SSH PTY reconnect waves",
        "renderer ACK",
        "xterm scheduler",
        "hidden output"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6836",
        "https://github.com/stablyai/orca/pull/6858",
        "https://github.com/stablyai/orca/pull/7002",
        "https://github.com/stablyai/orca/pull/7054"
      ],
      "invariant": "High-volume terminal output must stay bounded across daemon socket writes, SSH relay writer/decoder/source retention/reconnect, main model and projection admission, runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input. Every new SSH session offers V1 and every same-build relay supports it; legacy delivery is reachable only when capability negotiation proves the peer cannot use V1. Negotiated SSH spans remain exact and contiguous through activation, exit, cancellation, recovery, desktop projection, and required remote replacement; provisional activation data cannot project, reconnect may release it only into the exact attempt's private recovery quarantine after contract validation, and exit seals that quarantine against later same-token frames until ordered admission or exact cancellation proof. Reconnect checkpoint capture freezes exact provider-generation/PTy admission, cancels queued old work, and waits for the running raw completion before exposing its accepted checkpoint; timeout or failure detaches only that PTy's old model, makes the checkpoint unavailable, and releases the bounded fence without closing the shared provider, while the same failure outside an active exact migration remains generation-fatal and overlapping reconnects preserve any earlier outstanding fence. Pending renderer projection IDs are capped and compacted across split remainders, exit preparation owns its renderer fence through finalization, exit-time cancellation transfers published projections before proof commit, generation close fences late proof while draining exact projection waiters, closed-generation identity compacts without weakening stale rejection, canceled source-delivery retirement retains at most one ordered token per PTY, and pause/resume targets only the exact provider generation. Additional subscribers cannot stall the owner, while the required legacy primary retains backpressure.",
      "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1674 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/wsl-guest/protocol-backpressure.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/wsl-guest/dispatcher.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer.test.ts src/wsl-guest/dispatcher-client-writer.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts src/wsl-guest/dispatcher-client-writer.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts --reporter=dot"
      ],
      "testFiles": [
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/wsl-guest/protocol-backpressure.test.ts",
        "src/wsl-guest/dispatcher.test.ts",
        "src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts",
        "src/main/ssh/protocol/ssh-channel-multiplexer.test.ts",
        "src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts",
        "src/wsl-guest/dispatcher-client-writer.test.ts",
        "src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/wsl-guest/dispatcher.test.ts",
          "assertions": [
            "a saturated legacy primary remains required backpressure and is never detached as an additional subscriber"
          ]
        },
        {
          "file": "src/wsl-guest/protocol-backpressure.test.ts",
          "assertions": [
            "relay decoder accepts one maximum frame plus 1 MiB partial input and rejects one extra byte",
            "a throwing continuation clears retained input, releases one pause epoch, and publishes one typed ownership error"
          ]
        },
        {
          "file": "src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts",
          "assertions": [
            "write(false) owns one frame and later ordinary traffic waits for drain",
            "queued control is selected before ordinary PTY backlog at drain while each lane remains FIFO",
            "four-control fairness guarantees ordinary progress without starving control",
            "one coalesced liveness bypass is allowed per saturated epoch"
          ]
        },
        {
          "file": "src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts",
          "assertions": [
            "source ACK, cancellation, exit, request, and response control frames precede queued pasted PTY input after drain",
            "control and ordinary frames preserve lane FIFO while ordinary input progresses after four control writes"
          ]
        },
        {
          "file": "src/wsl-guest/dispatcher-client-writer.test.ts",
          "assertions": [
            "encoded producer frames stay below high-water-minus-reserve capacity",
            "one fixed-size filesystem compatibility frame is admitted only on an empty sink",
            "control remains reserved while producer retention stays bounded"
          ]
        },
        {
          "file": "src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts",
          "assertions": [
            "WSL stdin forwards write(false), callback settlement, and drain without claiming a live WSL topology"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-29",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/wsl-guest/protocol-backpressure.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 2.24,
          "summary": "Sixteen deterministic SSH relay/session/source/decoder files passed 192 tests, including exit-sealed private recovery, retained stale-transfer cancellation authority, exact private-frame proof watermarks, one retirement record across 10,000 same-PTY token rotations, stale-owner fallback, and scheduler rejection isolation; no live topology was exercised."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): deterministic provider/IPC contract now; terminal perf soak/report gate before promotion"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Focused main-process backlog and direct-SSH reconnect/memory/decoder tests are deterministic unit slices. On 2026-07-27 the source-credit reconnect case passed once in the full four-test Docker suite (15.7 seconds) and three consecutive isolated repeat-each runs (21.1, 19.8, and 15.3 seconds). On 2026-07-28 it passed against private recovery transfer in 17.7 seconds alone and 16.0 seconds in the full four-case suite; the combined perf soak still needs longer runtime history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Tests assert ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output plus projection IDs stay within exact caps, direct-SSH source/recovery memory and both frame decoders stay within exact caps, and 50-PTY reconnect isolates slow/failing siblings. On pre-fix 4bf54da9b, reconnect pause targeted the replacement provider, disposal omitted a pause-only generation, normal and generation-close exit paths never released the renderer preparation lease, and the projection-cap seam did not exist; the same oracles pass with exact generation indexing, paused-generation enumeration, barrier-owned exit leases, and the 1,024-ID transfer latch. The deterministic main-to-relay drain oracle failed with ordinary-2 and ordinary-3 ahead of a later control frame under the single FIFO, then passed with control-first lane selection and four-write ordinary fairness. On exact pre-fix baseline db167ea3d with test-only oracles, cancellation proof reclaimed the published projection span before transfer and generation close allowed a late proof to publish final exit; both deterministic oracles pass after proof acquisition and commit are separated under the exact deadline barrier. Before snapshot admission, the trailing span entered transferring instead of remaining open; after retaining model-sequence ends and reserving at the serialized fence, the joined main/runtime oracle passed for renderer and headless sources with upstream boundaries 4 then 8. Before cumulative partial ACK and source rotation, the ledger rejected ACK 40 of 100 and the multiplex seam detached instead of publishing recovered token B; both exact oracles pass while stale stream and source generations remain rejected. Before restore-record retirement, invalid-checkpoint recovery followed by restore/retry returned restoreRequired a second time instead of opening a fresh activation; the same deterministic oracle passes after exact response-settlement cleanup. With test-only oracles on pre-fix 4bf54da9b, an existing-owner mismatch lacked the stale-owner code and both shared authority and main fallback rows failed; the candidate types that refusal while stale fresh admission remains a subscriber and the retained principal and lease can still recover. Before the recovery-quarantine activation fix, completion was visible at source unit 4 while lease-held recovery ended at 8, so the fence rejected and cancellation failed; the same byte-identical seam now transfers held ranges only into private quarantine, admits output after exact body/fence validation, and the deployed Linux relay reconnect passes. Other controls previously failed with serial reattach, UTF-8-only accounting, and roughly 32 MiB decoder retention. Needs daemon-stream contract coverage and broader hidden-output/input-latency perf artifacts before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope. Historical prior account (preserved verbatim): Suggested ceilings: renderer in-flight <=8MB total, <=512KB per PTY plus active reserve, renderer queued chars <=2MB, dropped backlogs 0, hidden restore <=1000ms, active key median/worst <=75ms/300ms in perf scenarios. Always-on capability offers add no persisted setting reads, polling, scans, subprocesses, provider fanout, or reconnect-path reevaluation. Restore-record retirement adds one exact map-identity check at response settlement with no polling, timers, scans, subprocesses, or provider calls. The Docker SSH gate enforces median/worst typing below 500/2,000 ms; the current private-transfer artifact observed 5.5/16.3 ms during an exact 256 KiB stalled-credit plateau, 141.2/151.5 ms during 95 completed filesystem/Git bulk reads, and a 16.0-second reconnect. With 1,024 retained provenance candidates, 4,096 pathless chunks dropped from 78.84ms and 4,096 array replacements to 1.74ms and zero replacements. Brace-free 1 KiB output dropped from 20.32/79.12/318.23ms to 0.31/0.64/2.35ms across 4,096/16,384/65,536 chunks. Repeated ordinary 252,000-character tail checks dropped from 96.34/464.20/941.79/3,796.70ms to 3.21/15.68/31.34/129.72ms across 100/500/1,000/4,096 updates."
      },
      "promotionCriteria": [
        "Split daemon stream backpressure into a deterministic provider/IPC contract if full E2E is flaky.",
        "Record JSON artifacts with bytes, dropped counts, queue depth, timer drift, and key latency.",
        "Keep stress variants non-blocking until stable runtime history exists."
      ],
      "knownGaps": [
        "Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations  / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/ssh/ssh-multiplexer-transport-writer.test.ts: reports saturated epochs and their drain boundary exactly once. src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/main/ssh/ssh-multiplexer-transport-writer.test.ts remains historical and is not a passing result for the reduced current command.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1674 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Local daemon/provider and prior-version daemon topologies were not executed.",
        "Headed paired desktop, headless orca serve, folder workspace, and mixed-version client topologies were not executed.",
        "Physical WSL and Windows named-pipe/ConPTY topologies were unavailable and were not executed.",
        "Ubuntu 20.04/glibc 2.31 packaging was not physically executed; cross-target relay bundling is build evidence only.",
        "Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
        "Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
        "Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
        "Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-10\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts\",\"result\":\"passed\",\"durationSeconds\":21.33,\"summary\":\"2 test files passed, 609 tests passed on pushed commit 4fb14eac3897.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"returns a blocked wait result for Codex update prompts\",\"returns a blocked wait result for Codex workspace trust prompts\",\"returns a blocked wait result for generic Codex interactive prompts\",\"resolves tui-idle when a stale Codex prompt is followed by the ready header\"]}]",
        "Audit1931 (sources1928/1929): Delete the complete tail-wait memo suite: its sole current authored callback checks supplied fromTail/blocked field values. Retire all three broader memoization/equivalence/eviction assertion aliases; they are not backed by retained source callbacks. No scan-work budget, sustained output, physical terminal or resource measurement is assigned to this removed test. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'computeTerminalTailWaitState reports fromTail and blocked signals'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orca-runtime-tail-wait-memo.test.ts\",\n          \"assertions\": [\n            \"does not rebuild or repeatedly scan an ordinary saturated tail\",\n            \"memoized stamping matches recompute reference: blocked prompt split across chunks\",\n            \"stays equivalent across tail eviction beyond the retained cap\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Audit2377/2381 removes bundled-skill eligibility5 silent late-writer successful backup, layouts1 global forced backup, legacy-auto-update2 old release plus extra notes, and native-discovery7/13/18/19/21 OpenCode project, Pi home symlink, default Hermes root, requested-cwd agents symlink and standalone SSH-builder paired cwd checks. Lose those exact backupPath/bytes/global-link-lock/history/provider/label/path combinations and localized SSH-builder sample. Retained common owners are not identical replacements; no fresh validation is claimed for this reduced broad command.",
        "Audit2383 removes the complete antigravity-skill-discovery.test.ts suite. Lose the exact .gemini/config/skills path, home-antigravity source, antigravity owner, existence and contributing-root observation. Other providers exercise common discovery dispatch, not this exact catalogue row. No equivalent replacement or fresh validation of the reduced broad command is claimed.",
        "Audit2385 removes finder regular-depth and direct missing-root examples, the three-row staging-name matrix, and an initial unknown WSL-list record sample. Lose those isolated fixtures, exact backup name spellings and malformed prefix sequence; retained actual owners are not identical replacements. Missing-root case did not model disappearance after the production caller existence check. No fresh validation of this reduced broad command is claimed.",
        "Audit2389 removes whole skill-install-preview.test.ts plus destinations1 and recovery2. Lose missing-preview name/state/global identity/fixed codex+claude inventory, exact plain-global host identity return, and already-published receipt finalization fixture. No nonmutation assertion existed in preview; retained real home delivery and placed-canonical recovery are not identical complete replacements. No fresh validation is claimed.",
        "Audit2393 refresh2401 removes skill-installation original1 and only the original receiptless request case. Lose uninterrupted first-install status/exact placement count and public canonical receiptless conflict/unowned routing. Retain upstream request ownership tests and lower transaction interruption coverage byte-exact. Deleted guard case had no directory/content preservation assertion. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2397 review amendment removes whole empty-gzip, WSL provider error-mapping and remote-cancellation registry suites; two initial hostname-suffix/userinfo URL rows and initial-expired grant sample; linked-parent alias classification. Lose no-input custom gzip branch, WSL failure labels, basic registry lifecycle/duplicate-ID guard, exact hostname-suffix/userinfo input variants, prefetch expired-grant no-network and preexisting alias result alarms. Preserve the single initial wrong-port origin authorization case, original abort-after-begin cleanup/no-signal cancelUpload dispatch suite and original independent-copy modified-digest removable=false case. No equivalent complete replacement or fresh validation claimed for the remaining losses.",
        "Audit2404 removes whole skill-share-package-name.test.ts, skill-delete-plan original1/6 skill-delete-recovery original2 and skill-share-preparation original2. Lose lookup503 rejection/status propagation through prepare, explicit unblocked unordered alias-kind/canonical sample with cwd undefined, stale classification after +60000ms actual mtime change, successful first-pass single-move rollback/staged-path absence and prior-process preparation-root archive directory cleanup. Retained exact identities use cwd home; public stale guard submits timestamp1; recovery retry cases are not identical first-pass fixtures. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2412 removes whole useVirtualizedScrollAnchor.marks-restore-signal.test.ts (six fake-hook geometry/mark/convergence/user-takeover/clamp alarms), use-task-creation-draft-retention original3/4 (immediate discard mock-call count/unopened no-write), use-terminal-bulk-close-actions.placement original6/7 (absent new-agent append and one real history-publication count at consumed3/30 scale), PendingNativeChatCreation original6 (unmounted abort completion/timer cleanup), and wsl-move-dialog-store original1/9/13 (default whole-distro count/reference/reuse and rejected-preview/start refusal recovery). The history counter measures genuine publication work without entries/order/reopen assertions; its unique batching alarm is intentionally retired. Fake React scroll tests ignore dependency scheduling and cleanup; unique simulated arithmetic alarms are deliberately lost. Retained existing-terminal reorder is not new-agent append coverage; mounted handoff timeout is not abort coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2417 removes commit-actions-real-git original3/4 (ordinary clean cherry-pick and revert content, subject and current-branch samples), and pty-startup-ingress-exited-asker original8/12 (actual foreground-group read budget across100queued queries, and zero foreground reads across100normal chunks plus final emitted/accepted raw cursor equality). Counters measure actual callback work and scale is consumed; these internal-work alarms are deliberately retired. Retained unborn, conflict and sequencer cases are not equivalent ordinary-success coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2425 removes use-workspace-copy-status original5, which returns a fixture-supplied readError string through statusReadError. No consumer blocker or attempted branch switch established refusal; the unique error-forwarding sample is intentionally retired. Other copy ownership and stale-refresh cases are not equivalent error-path coverage. No equivalent replacement or fresh validation is claimed.",
        "Audit2432 removes BranchPicker.test.tsx original3, which only asserted onOpenChange(true/false) with an always-mounted mocked Popover. It never reopened the picker or consumed the callback in the parent status-refresh owner, despite its title. Lose that unique open/close notification alarm. Retained blocker/collision recovery and asynchronous post-unmount outcome cases are not equivalent replacement coverage. No fresh validation of the reduced selector is claimed.",
        "Module layout SSH policy: Retire the multiplexer private-clock saturation registration, the writer saturation transition-count registration and the changed-source dated writer/backpressure receipt. Retained byte delivery, lane order, fairness, settlement and cancellation cases are unvalidated by that historical receipt. No equivalent replacement, new execution, measured performance, live SSH/WSL or cross-platform proof is claimed. The unchanged WSL protocol receipt retains only its original command scope.",
        "Historical original SSH assertion metadata before policy cuts, preserved verbatim; removed assertions are not current coverage:\n{\n          \"file\": \"src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts\",\n          \"assertions\": [\n            \"write(false) owns one frame and later ordinary traffic waits for drain\",\n            \"queued control is selected before ordinary PTY backlog at drain while each lane remains FIFO\",\n            \"four-control fairness guarantees ordinary progress without starving control\",\n            \"one coalesced liveness bypass is allowed per saturated epoch\",\n            \"saturation and drain transitions are reported exactly once\"\n          ]\n        }\n{\n          \"file\": \"src/main/ssh/protocol/ssh-channel-multiplexer.test.ts\",\n          \"assertions\": [\n            \"self-imposed writer saturation suppresses false death and rebases both health clocks on drain\"\n          ]\n        }",
        "Historical complete dated writer/backpressure receipt retired after its source changed, preserved verbatim including executed command and path-only currentCommand; not current validation:\n{\n          \"date\": \"2026-07-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-multiplexer-transport-writer.test.ts src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.89,\n          \"summary\": \"Thirteen current-head deterministic files passed 150 tests across exit-sealed private recovery, stale-transfer cancellation authority, bounded latest-token retirement, restore retirement, fail-closed recovery cancellation, partial ACK and token rotation, reclaimed-span replacement, mux lane fairness, provisional activation, and exit-proof ordering; no live topology was exercised.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts --reporter=dot\"\n        }",
        "Historical provider scope before changed-source receipt retirement: [\"ssh\"]",
        "Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed.",
        "Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed.",
        "Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed.",
        "Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed.",
        "Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation.",
        "Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed.",
        "Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked.",
        "Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed.",
        "Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms.",
        "Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery.",
        "Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction.",
        "Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed.",
        "Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed.",
        "Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed.",
        "Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed.",
        "Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed.",
        "Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired.",
        "Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands.",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical.",
        "Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed.",
        "Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed.",
        "Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed.",
        "Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope.",
        "Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope.",
        "Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope.",
        "Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/wsl-guest/protocol-backpressure.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/wsl-guest/dispatcher.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer.test.ts src/wsl-guest/dispatcher-client-writer.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts src/wsl-guest/dispatcher-client-writer.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts --reporter=dot\"\n      ]\ntestFiles: [\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/wsl-guest/protocol-backpressure.test.ts\",\n        \"src/wsl-guest/dispatcher.test.ts\",\n        \"src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts\",\n        \"src/main/ssh/protocol/ssh-channel-multiplexer.test.ts\",\n        \"src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts\",\n        \"src/wsl-guest/dispatcher-client-writer.test.ts\",\n        \"src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/wsl-guest/dispatcher.test.ts\",\n          \"assertions\": [\n            \"a saturated legacy primary remains required backpressure and is never detached as an additional subscriber\"\n          ]\n        },\n        {\n          \"file\": \"src/wsl-guest/protocol-backpressure.test.ts\",\n          \"assertions\": [\n            \"relay decoder accepts one maximum frame plus 1 MiB partial input and rejects one extra byte\",\n            \"a throwing continuation clears retained input, releases one pause epoch, and publishes one typed ownership error\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/protocol/ssh-multiplexer-transport-writer.test.ts\",\n          \"assertions\": [\n            \"write(false) owns one frame and later ordinary traffic waits for drain\",\n            \"queued control is selected before ordinary PTY backlog at drain while each lane remains FIFO\",\n            \"four-control fairness guarantees ordinary progress without starving control\",\n            \"one coalesced liveness bypass is allowed per saturated epoch\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/protocol/ssh-channel-multiplexer-backpressure.test.ts\",\n          \"assertions\": [\n            \"source ACK, cancellation, exit, request, and response control frames precede queued pasted PTY input after drain\",\n            \"control and ordinary frames preserve lane FIFO while ordinary input progresses after four control writes\"\n          ]\n        },\n        {\n          \"file\": \"src/wsl-guest/dispatcher-client-writer.test.ts\",\n          \"assertions\": [\n            \"encoded producer frames stay below high-water-minus-reserve capacity\",\n            \"one fixed-size filesystem compatibility frame is admitted only on an empty sink\",\n            \"control remains reserved while producer retention stays bounded\"\n          ]\n        },\n        {\n          \"file\": \"src/main/agent-hooks/wsl-relay/wsl-hook-relay-sentinel.test.ts\",\n          \"assertions\": [\n            \"WSL stdin forwards write(false), callback settlement, and drain without claiming a live WSL topology\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  All earlier notes and dated/archived evidence retain original scopes.",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed.  Earlier notes and dated/archived evidence retain original scopes.",
        "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. All prior notes and archived receipts retain original scopes.",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Earlier notes, complete dated receipts and archived gaps retain their original scopes."
      ],
      "demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
    },
    {
      "id": "terminal-provider.daemon-startup-degraded-contract",
      "title": "Daemon startup reconcile and degraded fallback preserve provider identity",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-provider",
      "layer": "provider-contract",
      "surfaces": [
        "daemon startup",
        "degraded daemon",
        "fallback PTY",
        "provider ownership",
        "startup restore",
        "stable-pane reopen"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon", "local"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic provider contracts cover complete, incomplete, conflicting, refused, and identity-invalidated owner inventories; degraded fallback/current/legacy routing; repeated stale-binding classification; and fresh-session reattach without local fallback during unresolved ownership. Main IPC contracts cover exact persisted-binding retirement and one fresh replacement after confirmed absence. Acquisition-budget contracts preserve the pre-existing two-second shared RPC cap, one pending acquisition for later deadlines, one index for concurrent resolutions, post-timeout strict cleanup, and exact current-identity recovery while a legacy provider is unavailable. Scoped inventory contracts preserve established input routes while refusing ambiguous target ownership. Live Linux, Windows, WSL, SSH, paired-runtime, and packaged-upgrade journeys remain uncollected. Test-value audit1293 removes src/main/daemon/daemon-inventory-routing-authority.test.ts (5 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6830",
        "https://github.com/stablyai/orca/pull/6866",
        "https://github.com/stablyai/orca/pull/7002",
        "https://github.com/stablyai/orca/pull/12776"
      ],
      "invariant": "Daemon startup reconciliation must preserve valid live daemon sessions and reap only true orphans. A persisted binding stays fail-closed while any possible owner is incomplete, conflicting, refusing attach, or identity-invalidated, but complete authoritative absence from every configured provider must retire that exact stale binding and let retry or reopen converge without attaching it through local fallback or duplicating a PTY. Scoped inventories must retain complete provider evidence and established input routes. Later reader deadlines must not supersede a pending acquisition or extend its existing two-second RPC cap; explicit identity invalidation must still permit prompt exact-owner recovery.",
      "oracle": "Hold exact fallback, current-daemon, and legacy-daemon inventories behind controlled promises. Without unique incarnation proof, no attach may settle or dispatch until every provider answers. Complete zero-candidate inventories must report SessionNotFound; incomplete, duplicate, refused, and identity-invalidated attempts must remain owner-unverified. In degraded mode, repeated stale attempts scan each eligible provider once per attempt and dispatch no attach, then one explicit fresh spawn and exact reattach use only the recorded fresh route. Main IPC must compare-and-swap retire only the matching persisted PTY/incarnation, emit one synthetic exit, and create one different fresh PTY. After a deadline-obeying legacy provider times out a restore, a subsequent strict sweep must take a new inventory and stop a terminal created externally. Twenty later strict/diagnostic deadlines must share one provider RPC. One hundred concurrent resolutions over 4,096 rows must perform 8,192 id reads. Invalidating the current provider during a legacy scan must discover and reattach its exact live incarnation within the existing resolution budget. Unrelated ambiguity must not block scoped cleanup, while target ambiguity must still refuse it.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "provider contract unit/integration test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused provider contract tests now run locally; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical owner-resolver blob d35d2795d56e7e32c1ca99af6726fe6b92181881 is present in v1.4.176-rc.0@ddf64199fa, prod-release-1.4.176@8ddf575fe6, and origin/main@cb960408f2. It returns TerminalSessionOwnerUnverifiedError for both controlled complete-empty persisted PTYs and leaves degraded stale bindings unrecoverable. The candidate passes 535 of 535 registered tests. Restoring only the old predicate makes the unchanged four-file gate fail four of 535 tests; restoring the fix passes 535 of 535."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The pre-existing acquisition budget remains min(caller deadline, start plus two seconds). Later deadlines reuse that acquisition without extension or replacement; concurrent resolutions share one index (8,192 id reads for 4,096 rows and 100 readers). No scheduler, partial-index cache, polling, sleep, timer, subprocess, listener, or retry loop is added. Confirmed absence is not cached; repeated explicit attempts remain bounded to one fanout each. Exact fresh-route reattach adds no inventory or daemon spawn. Existing readers may share observations begun before their call within the original capped acquisition window; a universal post-caller freshness boundary and long diagnostic budgets are deferred. Missing-workspace ambiguous-list fallback batching remains pre-existing debt."
      },
      "promotionCriteria": [
        "Wire reconcileOnStartup or mark the production wiring gap explicitly.",
        "Cover priorWorktreeIds so renamed worktrees are not falsely reaped."
      ],
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Production startup reconcile wiring remains unproven.",
        "Prior-worktree aliases and renamed-worktree startup reconcile are not covered by the current executable corpus.",
        "Real daemon restart behavior is still covered only by lower-level synthetic exit and provider-contract tests.",
        "No live Linux, Windows, WSL, SSH, headed/headless paired-runtime, folder-workspace, or mixed-version packaged-upgrade journey was run for stale-owner recovery.",
        "Test-value audit1293 removes src/main/daemon/daemon-inventory-routing-authority.test.ts (5 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required."
      ],
      "demotionRule": "Cannot promote while restored daemon ids or routing operations can silently route to local fallback."
    },
    {
      "id": "terminal-provider.startup-shutdown-authority",
      "title": "Cold-start terminal shutdown targets the installed daemon provider",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-provider",
      "layer": "main-provider-contract",
      "surfaces": [
        "daemon startup",
        "renderer terminal close",
        "runtime terminal stop",
        "restored terminal teardown"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: A real daemon server over a local socket proves a fresh adapter can kill a live session before any prior client operation. Main-process tests prove renderer IPC, runtime kill, and runtime exact-stop wait for the provider swap and issue zero shutdowns to the fallback provider, while SSH spawn and kill bypass the local barrier. The same shared logic runs on Linux and Windows; live platform runs remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/7742",
        "https://github.com/stablyai/orca/pull/7836"
      ],
      "invariant": "A local PTY shutdown requested during desktop cold start must resolve its provider only after daemon startup settles, and a fresh daemon adapter must connect before issuing the destructive request; a fallback provider must never falsely acknowledge shutdown while the restored daemon session remains live, and SSH shutdown must not wait on local startup.",
      "oracle": "Hold the desktop provider-startup promise unresolved, request shutdown through renderer IPC and both runtime-controller entry points, install the daemon provider, and assert the fallback receives zero shutdowns while the daemon receives exactly the requested kill; prove the provider gate opens as soon as daemon authority settles even while optional hook startup remains unresolved, and prove an SSH spawn and kill complete without touching either local barrier. Separately, spawn a session through one adapter, kill it through a fresh unconnected adapter, and assert the daemon no longer lists it.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "focused main-process provider and IPC contract tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The focused deterministic gate passed locally once and needs CI soak history."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Removing the adapter connection reproduces DaemonProtocolError: Not connected, and removing the renderer startup barrier routes shutdown to the fallback. The new runtime-controller barrier assertions also fail against the prior provider-before-startup shape; saved CI red artifacts remain uncollected."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The provider-authority barrier and connection guard add no polling, timers, subprocesses, session inventories, or provider fanout; runtime exact-stop's existing post-stop verification inventory is unchanged. Shutdown does not wait for optional hook startup once daemon authority settles. Each path awaits one bounded provider promise; DaemonClient.ensureConnected is an O(1) no-op when connected and deduplicates concurrent connection attempts when disconnected. Tests deterministically count zero fallback shutdowns, exactly one target shutdown per entry point, and exactly one control-plus-stream handshake for concurrent fresh-adapter shutdowns."
      },
      "promotionCriteria": [
        "Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Collect a Windows cold-start close or exact-stop run against a preserved daemon PTY.",
        "Attach saved red/green artifacts for all three provider-selection entry points."
      ],
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No live Electron restart-to-close journey is included; provider and IPC contracts cover the race deterministically.",
        "The bounded daemon-startup fail-open to LocalPtyProvider remains an accepted boot-over-persistence tradeoff tracked by issue #5232.",
        "Daemon process death and the resulting Windows ConPTY PowerShell FailFast are separate from provider-selection shutdown authority."
      ],
      "demotionRule": "Keep experimental or demote if the gate flakes without a product or harness bug, if any local shutdown reaches fallback before startup settles, or if shutdown adds inventory scans or retry loops."
    },
    {
      "id": "terminal-provider.snapshot-capability-renderer-responsiveness",
      "title": "PTY snapshot capability discovery never blocks renderer JavaScript",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-provider",
      "layer": "renderer-ipc",
      "surfaces": [
        "renderer startup",
        "cold terminal restoration",
        "hidden terminal parking",
        "SSH terminal restoration"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": ["daemon", "ssh"],
      "coverageNotes": "Audit1939 (sources1934/1935): Pruned hidden-view suite retains local rank and age eviction only; its snapshot-capability and paired-owner admission examples are removed. No assertion object maps to this source, so unrelated aliases remain untouched. Existing physical stall selectors and their original dated receipts retain their independent scope; they do not validate removed capability units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: An Electron main-stall oracle proves capability lookup is asynchronous. Startup prefetch covers restored primary and split-pane PTY identities before cold activation, while unknown providers remain eager. Docker SSH journeys prove remote terminals still remount eagerly and reclaim their authenticated PTY owner after restart. Audit1292: The entire terminal-provider snapshot capability suite is removed. Unchanged-set scan suppression,512 batching/IPC, timeout/unknown state, stale-result fences, success/failure retry signals, unresolved cadence, identical-set retries and closed/reappearing-ID reset alarms are lost. Remaining Electron responsiveness evidence does not establish equivalent unit coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
      "motivatingLinks": ["https://stablygroup.slack.com/archives/C0BD60A5J85/p1785524559818629"],
      "invariant": "PTY snapshot capability discovery must never synchronously block renderer JavaScript. Restored daemon capability must be known before workspace readiness enables cold activation; unknown or legacy capability must remain eager. A healthy SSH provider must return definitive false without polling. One unresponsive capability batch must fail open within one second regardless of PTY count, and stale async responses must not update current bindings.",
      "oracle": "Audit1939 (sources1934/1935): Pruned hidden-view suite retains local rank and age eviction only; its snapshot-capability and paired-owner admission examples are removed. No assertion object maps to this source, so unrelated aliases remain untouched. Existing physical stall selectors and their original dated receipts retain their independent scope; they do not validate removed capability units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): During an injected 1.5-second Electron main-thread stall, a renderer-owned 50ms interval must keep a maximum gap below 500ms and each API call must return within 100ms. The production cold-activation journey must still mount at most three of eight daemon tabs after reload, while Docker SSH restoration remains eager.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts --reporter=dot",
        "pnpm exec electron-vite build --mode e2e",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/pty-snapshot-capability-main-stall.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3"
      ],
      "testFiles": [
        "src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx",
        "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
        "src/renderer/src/components/terminal-pane/parking/retention/terminal-hidden-view-parking.test.ts",
        "tests/e2e/pty-snapshot-capability-main-stall.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/pty-snapshot-capability-main-stall.spec.ts",
          "assertions": [
            "a 1.5-second main stall leaves renderer interval gaps below 500ms",
            "capability calls return to renderer JavaScript within 100ms"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-31",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/pty-snapshot-capability-main-stall.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
          "result": "passed",
          "durationSeconds": 16.8,
          "summary": "Three 1.5-second main stalls produced 32 renderer calls each; maximum interval gaps were 70.3ms, 70.1ms, and 71.6ms, and maximum call-return durations were 0.1ms, 0.1ms, and 0.2ms. The synchronous baseline produced a 1465.1ms interval gap and 1464.2ms call-return duration."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "focused Electron responsiveness and cold-restore journeys"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic Electron oracle passed three consecutive local runs; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical Electron oracle failed with synchronous sendSync at a 1465.1ms renderer interval gap and 1464.2ms call-return duration, then passed three times with async invoke at no more than 71.6ms and 0.2ms respectively. The preload test also fails on the synchronous baseline."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Capability requests are deduplicated by PTY ID, sent in bounded 512-ID batches, cached after a definitive result, and retried only for unknown results. SSH now returns definitive false. One unresponsive batch fails open after one second without scanning further batches. No subprocesses or provider inventories are added."
      },
      "promotionCriteria": [
        "Run the Electron main-stall oracle for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Collect Windows and Linux desktop cold-restore coverage.",
        "Add a headed paired-desktop cold-restore journey if provider capability semantics move into the remote runtime."
      ],
      "knownGaps": [
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The main-stall and local daemon cold-restore Electron journeys currently run on macOS only.",
        "Docker SSH proves the Linux relay/provider path but not a Linux desktop renderer.",
        "This gate proves renderer responsiveness to main stalls; it does not identify the cause of the reported production hard freeze.",
        "Audit1292: The entire terminal-provider snapshot capability suite is removed. Unchanged-set scan suppression,512 batching/IPC, timeout/unknown state, stale-result fences, success/failure retry signals, unresolved cadence, identical-set retries and closed/reappearing-ID reset alarms are lost. Remaining Electron responsiveness evidence does not establish equivalent unit coverage.",
        "Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
        "Audit1939 (sources1934/1935): Pruned hidden-view suite retains local rank and age eviction only; its snapshot-capability and paired-owner admission examples are removed. No assertion object maps to this source, so unrelated aliases remain untouched. Existing physical stall selectors and their original dated receipts retain their independent scope; they do not validate removed capability units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'selects only reachable hosts advertising the paired parking contract'; 'shares the capability Set across status-only changes and replaces it on membership changes'; 'allows local daemon sessions owned by the worktree'; 'allows folder-workspace sessions owned by the workspace'; 'rejects separator-less local PTY ids that lack a daemon session model'; 'rejects tabs that do not have a PTY yet'; 'rejects daemon sessions owned by another worktree'; 'rejects SSH and remote runtime PTY handles'; 'accepts every snapshot-backed pty regardless of policy'; 'accepts SSH ptys only when the SSH-parking policy is enabled'; 'accepts paired ptys only for the exact snapshot-capable owner'; 'rejects paired, fail-open, foreign, and null ptys without capability evidence'; 'parks hidden local terminal renderers after the idle delay'; 'parks a hidden SSH worktree only under the SSH restore policy'; 'defers preserved-daemon snapshot authority to the watcher coverage gate'; 'never parks when the settings kill switch disables parking'; 'keeps renderers mounted while visible, measuring, portaled, or before the delay'; 'honors a per-call cold-park delay override'; 'holds an otherwise past-deadline candidate out of park until the measure cool-down ends'; 'keeps the renderer mounted when any terminal lacks snapshot-backed restore'; 'keeps renderers mounted while a tab has startup or activation work pending'; 'ignores mirrored activation residue after a capable paired PTY exists'; 'parks an idle hidden local tab and honors the kill switch'; 'ignores mirrored activation residue after a capable paired PTY exists'; 'honors a per-call cold-park delay override'; 'holds an otherwise past-deadline tab out of park until the measure cool-down ends'; 'keeps recent hidden local worktrees hot up to the retain limit'; 'selects nothing when the settings kill switch disables parking'; 'does not cold-park terminals without local snapshot recovery'; 'keeps visible, measuring, portaled, and pending terminals mounted'; 'keeps visible and recent inactive terminal tabs mounted'; 'cold-parks the oldest inactive local tabs beyond the retain limit'; 'selects nothing while the post-measure cool-down is active'; 'cold-parks aged inactive local tabs even when under the retain limit'; 'never cold-parks the single most-recently-hidden (last-active) tab'; 'selects nothing when the settings kill switch disables parking'; 'does not cold-park inactive terminal tabs without local snapshot recovery'; 'keeps portaled, pending-startup, and pending-activation terminal tabs mounted'."
      ],
      "demotionRule": "Demote if capability discovery reintroduces synchronous renderer IPC, cold daemon tabs mount eagerly despite authoritative snapshots, SSH capability polls after a definitive response, or the renderer gap budget flakes without a product or harness bug."
    },
    {
      "id": "terminal-provider.ssh-remote-reattach-contract",
      "title": "SSH restore and remote-runtime recovery preserve live terminal ownership",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-provider",
      "layer": "provider-contract",
      "surfaces": [
        "SSH deferred restore",
        "direct SSH reconnect finalization",
        "direct SSH folder workspace reattach",
        "direct SSH split-pane retry ownership",
        "same-authority terminal correction",
        "remote-runtime host surface materialization",
        "remote-runtime mirror polling",
        "remote-runtime network recovery",
        "pane-scoped remote terminal recovery errors",
        "bounded terminal error surfaces",
        "paired client sleep/wake reconnect",
        "terminal create idempotency",
        "provider listing",
        "reattach",
        "provider reattach incarnation fencing",
        "unknown liveness"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["ssh", "remote-runtime", "wsl"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": ["ssh", "remote-runtime"],
      "coverageNotes": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires whole host-surface-replacement and create-handoff suites, removing their compound unit command tokens, test-file entries and assertion references. Fake polling/deadline/subscription, supplied stale-handle ownership, close and replacement examples are intentionally lost without equivalent replacement. The unrelated Linux paired multi-pane reconnect receipt stays verbatim with its original scope. No fresh SSH/provider/network/PTY recovery, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3342 retires the complete client create-outcome identity/options/recovery suite and the malformed-or-contradictory repo-owner response matrix. Client replay identity, options, no-downgrade, quiescence/budget/manual retry, authoritative probe-error and malformed-owner refusal alarms are intentionally lost without equivalent replacement. Remaining repo-owner late catalog and old-host re-adoption boundaries do not replace them. The unrelated Linux paired-reconnect receipt stays verbatim with its original scope. Surviving selectors are unexecuted here; no fresh SSH/provider/process-deduplication, mobile, mixed-version or cross-platform validation is claimed. Audit3329 execution amendment: the reduced one-suite reconnect selector passed on Linux (1 case). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only this one local deterministic unit case, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS and two-case Linux receipts remain archived verbatim. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: keeps a sidebar row for every still-live pane after a long sleep — Whole suite: 279 lines manually replay renderer ownership registry/status writes, snapshot patch/set, six-pane fixture inventory, and sidebar selectors/builders; expected pane IDs are production-computed. Does not run sleep/wake/transport or actual sidebar entry. Retires reconnect row-preservation assembly alarm.; still retires the regular TUI surface after an explicit terminal exit — Ordinary explicit-exit callback/map cleanup is repeated in the stale/new stream lifecycle case below. Retires separate regular-TUI baseline; keeper is not equivalent process/UI proof.; asks the HUB to recover an expired SSH pane and rebinds the host identity — Expired SSH owner error must ask the owning HUB to recover, then adopt fixed replacement handle, resubscribe and report rebind; actual transport dispatch and handle state prevent wrong-client recovery.; does not recover a pane whose relay reply was an identity mismatch — Identity mismatch means a different live PTY, so actual transport must surface refusal without recover/create, keeping original identity. Prevents destructive duplicate agent recovery.; fails closed when an older HUB cannot recover an expired SSH pane — Old HUB method_not_found is scripted mock refusal/error echo with no actual skewed host; repeats generic recovery failure propagation. Retires old-host recovery fallback refusal example.; names a held recovery's stopped WSL distro in readable copy, not the raw hold code — Pins exact WSL stopped-distro error prose after mock code; translation/copy assertion with no actual held recovery behavior. Retires readable-copy alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces runtime-environment-ssh-state.test.ts, intentionally losing metadata membership-pruning/new-target-only-read and other-environment/local-bucket isolation alarms. Preserve generation/failed-full-refresh assertion and unknown-target authoritative-list reread; these narrower cases are not equivalent replacements. The unchanged active two-case Linux reconnect materialization/sidebar receipt and covered platform retain their exact scope and do not validate the reduced SSH state selector. Preserve unrelated SSH assertions, selectors and archived history. No fresh SSH discovery, provider/PTY/network, rendered, mobile, mixed-version, cross-platform or full-gate execution is claimed. Audit3315 execution amendment: the reduced two-suite reconnect selector passed on Linux (2 cases). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only these two local deterministic unit cases, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS receipt remains archived verbatim. Audit 3312 retires the ordinary six-pane distinct-live-handle reconnect/resubscription alarm from paired-reconnect-multi-pane-materialization.test.ts. The unchanged parked-pane activation/rematerialization case remains narrower and is not an equivalent replacement. The complete prior seven-contract macOS receipt is archived as historical evidence; it does not validate the reduced selector. No fresh socket, PTY, sleep/wake, provider, platform, mobile, mixed-version or rendered execution is claimed. Audit3096: remove the deleted reconnect-banner selector and its two UI aliases. The reduced recovery-state selector retains only the deadline cancelling pending backoff and explicit retry owning a new epoch alias; healthy-replacement stale-schedule and independent caller-cutoff cancellation aliases retire. Other retained state cases cover reentrant retry, owner settlement and same-epoch parked revival, without replacing those removed alarms. Prior admission-selector retirement, archived July 28 receipt, unrelated selectors/claims/receipts and old gaps remain unchanged; no fresh execution is claimed. Audit3086: retire the destroyed fresh-session fallback settlement/non-destructive reattach alias and its direct selector; retain the detach/attach selector and assertion unchanged. The retained admission cases cover adopt-before-data and explicitly buffered-death admission without a new spawn, without replacing fallback retirement. July 28 evidence was already archived by audit3077; no duplicate retirement or new execution is claimed. Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer coverage proves retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes keep their PTY bindings through disconnect and reconnect, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. A mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current-transport recovery clears every error that transport surfaced without clearing or displaying a sibling pane's errors, while transport suppression, pane retention, and the rendered surface are independently bounded. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps. The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical. The test-value audit removes standalone unwritten/released renderer-authority and cross-scope request-count examples. The retained synthetic mirror/store/sidebar and pending-inventory checks do not establish real PTY byte ownership, SSH reconnection or equivalent replacement coverage; historical commands and results remain historical. The test-value audit removes direct join/label ledgers, immediate failure and negative-only stale/removal/partial-authority examples, plus the standalone retained/live event projection. Retained synthetic store/hydration compositions do not establish real SSH continuity, remote authority delivery or equivalent replacement alarms. Historical commands and results remain historical. The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms. The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage. The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical. The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage. Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed. Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-3107",
        "https://github.com/stablyai/orca/pull/12664",
        "https://github.com/stablyai/orca/pull/6951",
        "https://github.com/stablyai/orca/pull/6955",
        "https://github.com/stablyai/orca/pull/6979",
        "https://github.com/stablyai/orca/pull/7009",
        "https://github.com/stablyai/orca/pull/8597",
        "https://github.com/stablyai/orca/issues/11541",
        "https://github.com/stablyai/orca/issues/15141",
        "https://github.com/stablyai/orca/issues/12685",
        "https://github.com/stablyai/orca/issues/12902"
      ],
      "invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once. Direct SSH disconnect, reconnect, and wake must keep PTY bindings and relay identity, and target snapshot hydration/reconnect cannot reset sibling SSH, local, WSL, or runtime-owned state. Every restored remote terminal must preserve its provider PTY identity, including the authoritative incarnation returned by a successful session-ID reattach. After a recoverable partition the same authenticated runtime must reattach the same PTY, reject detached input, apply the latest viewport, and report healthy only after authoritative replay. A successful one-shot reachability probe may replace a pre-ready shared-control socket, but waiting RPCs must continue onto the replacement under their original deadline without duplicate host delivery or retained request bytes. Automatic PTY recovery stops after one bounded minute without a fatal terminal error; a manual reconnect starts a newly fenced epoch against the same PTY, and closed panes retain no recovery UI state. Successful current-transport recovery must clear every stale error surfaced for that pane without clearing or displaying a sibling pane's error; a later genuine failure must remain visible. Each transport retains at most eight suppressed messages, each pane retains at most eight distinct messages, and the rendered surface retains at most 24 lines and 4,000 characters. One capability-gated terminal-create mutation must produce at most one host PTY across an unknown response outcome, remain manually retryable after cutoff, and never let a stale completion replace a newer pane lifecycle. Reconnect must alternate exact activation with authoritative inventory so neither a stale activation response nor an activation failure can strand or retire a pane, and activating a parked surface whose persisted binding was already retired must respawn it rather than report a changed owner after signalling its exit.",
      "oracle": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit3359 retires whole host-surface-replacement and create-handoff suites, removing their compound unit command tokens, test-file entries and assertion references. Fake polling/deadline/subscription, supplied stale-handle ownership, close and replacement examples are intentionally lost without equivalent replacement. The unrelated Linux paired multi-pane reconnect receipt stays verbatim with its original scope. No fresh SSH/provider/network/PTY recovery, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3342 retires the complete client create-outcome identity/options/recovery suite and the malformed-or-contradictory repo-owner response matrix. Client replay identity, options, no-downgrade, quiescence/budget/manual retry, authoritative probe-error and malformed-owner refusal alarms are intentionally lost without equivalent replacement. Remaining repo-owner late catalog and old-host re-adoption boundaries do not replace them. The unrelated Linux paired-reconnect receipt stays verbatim with its original scope. Surviving selectors are unexecuted here; no fresh SSH/provider/process-deduplication, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: keeps a sidebar row for every still-live pane after a long sleep — Whole suite: 279 lines manually replay renderer ownership registry/status writes, snapshot patch/set, six-pane fixture inventory, and sidebar selectors/builders; expected pane IDs are production-computed. Does not run sleep/wake/transport or actual sidebar entry. Retires reconnect row-preservation assembly alarm.; still retires the regular TUI surface after an explicit terminal exit — Ordinary explicit-exit callback/map cleanup is repeated in the stale/new stream lifecycle case below. Retires separate regular-TUI baseline; keeper is not equivalent process/UI proof.; asks the HUB to recover an expired SSH pane and rebinds the host identity — Expired SSH owner error must ask the owning HUB to recover, then adopt fixed replacement handle, resubscribe and report rebind; actual transport dispatch and handle state prevent wrong-client recovery.; does not recover a pane whose relay reply was an identity mismatch — Identity mismatch means a different live PTY, so actual transport must surface refusal without recover/create, keeping original identity. Prevents destructive duplicate agent recovery.; fails closed when an older HUB cannot recover an expired SSH pane — Old HUB method_not_found is scripted mock refusal/error echo with no actual skewed host; repeats generic recovery failure propagation. Retires old-host recovery fallback refusal example.; names a held recovery's stopped WSL distro in readable copy, not the raw hold code — Pins exact WSL stopped-distro error prose after mock code; translation/copy assertion with no actual held recovery behavior. Retires readable-copy alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit 3318 reduces runtime-environment-ssh-state.test.ts, intentionally losing metadata membership-pruning/new-target-only-read and other-environment/local-bucket isolation alarms. Preserve generation/failed-full-refresh assertion and unknown-target authoritative-list reread; these narrower cases are not equivalent replacements. The unchanged active two-case Linux reconnect materialization/sidebar receipt and covered platform retain their exact scope and do not validate the reduced SSH state selector. Preserve unrelated SSH assertions, selectors and archived history. No fresh SSH discovery, provider/PTY/network, rendered, mobile, mixed-version, cross-platform or full-gate execution is claimed. Audit 3312 retires the ordinary six-pane distinct-live-handle reconnect/resubscription alarm from paired-reconnect-multi-pane-materialization.test.ts. The unchanged parked-pane activation/rematerialization case remains narrower and is not an equivalent replacement. The complete prior seven-contract macOS receipt is archived as historical evidence; it does not validate the reduced selector. No fresh socket, PTY, sleep/wake, provider, platform, mobile, mixed-version or rendered execution is claimed. Audit3096: remove the deleted reconnect-banner selector and its two UI aliases. The reduced recovery-state selector retains only the deadline cancelling pending backoff and explicit retry owning a new epoch alias; healthy-replacement stale-schedule and independent caller-cutoff cancellation aliases retire. Other retained state cases cover reentrant retry, owner settlement and same-epoch parked revival, without replacing those removed alarms. Prior admission-selector retirement, archived July 28 receipt, unrelated selectors/claims/receipts and old gaps remain unchanged; no fresh execution is claimed. Audit3086: retire the destroyed fresh-session fallback settlement/non-destructive reattach alias and its direct selector; retain the detach/attach selector and assertion unchanged. The retained admission cases cover adopt-before-data and explicitly buffered-death admission without a new spawn, without replacing fallback retirement. July 28 evidence was already archived by audit3077; no duplicate retirement or new execution is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Deterministic tests cover bounded stale-handle replacement, suspended heartbeat clocks, cold and established subscription failure, ten partition/recovery cycles, automatic-recovery cutoff, manual reconnect, and direct SSH binding retention. They assert SSH state changes leave PTY bindings in place, relay identity survives, and another target/local/WSL/runtime panes remain byte-identical through target snapshot hydration and reconnect. Both remount callbacks consume split-count activity suppression, intentional dispose emits no failure/timeout, and a same-attempt StrictMode remount still owns one timeout. Hydration clears an untrusted PTY hint without clearing its current pending owner, healthy current-authority bindings suppress correction, hydration finalizes once, and reconnect emits no paired close lifecycle. A provider-level session-ID reattach returns an incarnation, then a legacy exit without an incarnation must resolve to that returned identity rather than minting a fallback identity. The shared-control oracle withholds the first encrypted ready frame, starts one RPC, triggers the successful-probe refresh, then requires exactly two client connections, one host request, a successful response, zero pending calls, and zero retained request bytes. Tests also assert one unsubscribe per remote-runtime epoch, observable recovery phases, stable PTY identity, resumed snapshot/output/input, no healthy state before replay, no retry or input after cutoff, a new manual epoch against the same PTY, quiet recovery UI with an explicit Reconnect action, pane-close state cleanup, one stable create mutation id, old-runtime no-retry behavior, cross-process PTY adoption, and bounded in-flight coordination. A focused recovery oracle surfaces two distinct failures through one transport, completes authoritative replay, and requires both matching clear callbacks; pane-state tests require only the active pane's error to render, matching-pane recovery to preserve sibling and unrelated errors, dismissal to re-admit later failures, and distinct storms to retain only the newest eight messages within 24 lines and 4,000 characters. The retained store replacement assertion observes one atomic pane/tab subscriber publication; repeated rotations and snapshot-first pending-restart migration no longer have their direct store examples.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot",
        "pnpm exec electron-vite build --mode e2e",
        "pnpm run build:web-from-renderer",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts",
        "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
        "src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts",
        "src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts",
        "src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts",
        "src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts",
        "src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts",
        "src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts",
        "src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts",
        "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
        "src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
        "tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts",
        "src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts",
        "src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts",
        "src/main/ipc/ssh/ssh.test.ts",
        "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
        "src/main/ssh/connection/ssh-connection-manager.test.ts",
        "src/main/ssh/connection/ssh-connection.test.ts",
        "src/preload/ssh-authority-forwarding.test.ts",
        "src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts",
        "src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts",
        "src/shared/ssh-retained-payload-admission.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts",
          "assertions": [
            "a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts",
          "assertions": [
            "ten synthetic partition cycles retain one PTY identity, deliver each held detached input exactly once and release each epoch subscription exactly once; decoded live input/output remains current"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts",
          "assertions": [
            "the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch"
          ]
        },
        {
          "file": "src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts",
          "assertions": [
            "a suspended client receives a fresh probe deadline after resume and post-resume activity clears it"
          ]
        },
        {
          "file": "src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts",
          "assertions": [
            "one authenticated client/worktree mutation derives a stable server-owned terminal handle",
            "an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup",
            "retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning",
            "in-flight mutation coordination is bounded and releases capacity after settlement"
          ]
        },
        {
          "file": "src/main/ssh/connection/ssh-connection-manager.test.ts",
          "assertions": [
            "disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement"
          ]
        },
        {
          "file": "src/main/ssh/connection/ssh-connection.test.ts",
          "assertions": [
            "late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state"
          ]
        },
        {
          "file": "src/preload/ssh-authority-forwarding.test.ts",
          "assertions": [
            "full authority crosses Electron IPC without loss",
            "partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped",
            "variable-form host-qualified worktree requests retain fail-closed outcomes in their return type"
          ]
        },
        {
          "file": "src/shared/ssh-retained-payload-admission.test.ts",
          "assertions": [
            "retained connection states reject partial or malformed authority",
            "only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation",
            "shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation"
          ]
        },
        {
          "file": "src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts",
          "assertions": [
            "partial runtime authority is rejected through the captured subscription callback before environment state receives it"
          ]
        },
        {
          "file": "src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts",
          "assertions": [
            "held replies from an old generation cannot replace a newer generation; failed full refresh preserves live state behind queued metadata",
            "an unknown target triggers an authoritative list reread"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts",
          "assertions": [
            "abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-11-11",
          "runner": "local",
          "platform": "linux",
          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot --maxWorkers=2",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 1.99,
          "summary": "Audit3329 focused candidate run: 1 suite / 1 deterministic unit case passed for parked-pane reconnect materialization. currentCommand names the same gate selector; executed command adds background launch and two-worker flags. This is local fake-runtime/store evidence only, not the complete gate, authenticated SSH/PTY/network, rendered Electron, provider, sleep/wake, mobile, mixed-version or cross-platform validation. Re-executed after updating onto main 985176b11bbb92175043a8d302581412d703e81c; unchanged finite reviewed source and owner identities."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 150,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1301; any retained unchanged-source receipts apply only to their own commands. Historical account: Focused renderer contracts, one current 627-test direct SSH run, and current Docker/Linux reconnect and six-terminal cold-restore journeys pass locally. One pressure run entered reconnect while waiting for its seventh marker; later runs delivered all markers but exposed an independent disappearing-second-file fixture race. The corrected two-reader single-file load passed the complete 4/4 suite while retaining concurrent stream pressure. Live multi-target fanout still needs CI soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1301 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The remote-runtime fault tests failed before the recovery changes by leaving a cold restored subscription detached, reporting connected before authoritative replay, delivering a fatal setup error twice, and allowing an unknown create outcome to spawn again after process-local state was lost. For STA-3107, reverting #11542 in the six-pane multiplex harness leaves exactly one parked pane without a resubscribed handle while its siblings recover; before #12664, the first post-sleep host snapshot erases every stale client-owned sidebar row despite live tabs and host PTYs. The deterministic contracts pass after host activation rematerializes the missing pane and client-written ownership, rather than freshness, controls row retention. On exact pre-fix HEAD 939719443, the split-pane store, fresh-spawn, and reattach oracles failed because the first success removed pending authority and the sibling could not bind; the same three oracles pass after live bindings retain the exact attempt ID. On exact committed HEAD d501f2e96, primary-exit-before-sibling and primary/non-primary split-detach oracles failed because live authority was deleted during the empty gap or transferred to only one resulting tab; all three pass after continuation-gap preservation and two-sided detach projection. On exact committed HEAD d44ea382b with test-only oracles, a pending-only all-null detach deleted the attempt ledger, a sibling mounted after first success committed without its lease, and that sibling could bind after authority rotation; all three pass after pending-only projection and retained-live-lease capture with provider retirement. On exact committed HEAD 9fa84dacf, the production-manager in-progress oracle rejected the fresh authority and the forward-removal barrier delayed stale transport cancellation; both pass after replacement starts cancellation immediately, shares concurrent fresh callers, and waits for teardown before connecting. On exact committed HEAD e5ba9a9e5, overlapping disconnect allowed a replacement connect before forward teardown completed and delayed transport cancellation behind that barrier; disconnect, removal, and terminate now share a target lifecycle barrier, start transport cancellation immediately, retain captured-session identity, and admit the replacement only after cleanup. On exact committed HEAD 9a29e7a81, a rejected forward teardown short-circuited the lifecycle while transport disconnect was pending, removal left its captured relay session alive, same-turn connect escaped admission, and reset remained outside the target barrier; the exact failure oracles pass after both cleanup branches settle, captured sessions always retire, admission is authority-fenced, and reset shares the barrier. On exact committed HEAD 47c7198f2, reset's remaining bespoke forward teardown could still reject after authority rotation but before captured-session retirement; reset now uses the same hardened session teardown and a failed reset remains cleanly retryable. Other direct SSH tests encode red conditions for non-atomic binding clear, cross-target retry, folder omission, duplicate same-authority attempts, hydration overwrite, terminal finalization delayed behind provider work, obsolete-authority pending-spawn adoption, Git lineage namespace mismatch, and snapshot PTY hint promotion without exact-attempt acknowledgement. Existing SSH and stale-handle reattach coverage remains green. Needs WSL, paired-close, and a patched live remote-runtime partition journey before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Direct SSH terminal invalidation and retry each use one exact-target store publication and execute before provider discovery; another target's five occupied provider slots cannot delay terminal finalization. Each split-pane completion or delayed mount adds constant-time pending/live lease lookups and no provider listing, polling, subprocess, cross-tab scan, or new fanout; two mounted leaves still perform exactly their two existing provider operations. Delayed snapshot placement retains at most one 10-second store subscription and timer per target; supersession and stop abort both immediately, remove the listener, and clear the timer. The scheduler caps locally unsettled detected-worktree work at five with a two-call late-work allowance. Remote-runtime recovery allocates at most one backoff timer and one one-minute deadline per detached pane, then stops all PTY retry work until explicit user action. Each transport suppresses at most eight distinct error strings and emits at most eight clear callbacks on recovery; each live pane retains at most eight messages, and every message and joined display is clipped to 24 lines and 4,000 characters. Explicit split close and pane replacement release their entries. This adds no provider request, polling, subprocess, or terminal-output work. Timers, accepted-snapshot listeners, stale streams, and pane UI entries are released on health, cutoff, rebind, removal, detach, or destroy; ten-cycle tests prove one unsubscribe per epoch. Common terminal input/output paths add only bounded state checks. No live large-terminal-map direct SSH timing is claimed."
      },
      "promotionCriteria": [
        "Use deterministic fake providers for failure and unknown-liveness cases.",
        "Keep environment-dependent live SSH tests as soak until stable.",
        "Include reconnect/polling artifacts that identify provider, connection id, and lease state."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/spawn/pty-connection-split-spawn.spec.ts. Intentionally lose these named regression alarms without replacement: clears the mobile-fit pane binding when the pane connection is disposed — Pane dispose clearing the mobile-fit binding and PTY dataset loses this direct example.; continues post-spawn size reconcile after a transient mobile presence lock — Size reconciliation continuing after a transient phone-presence lock loses this direct example.; spawns the delayed primary pane of an issue-command split when its sibling owns the tab PTY fallback — Delayed primary split spawning independently after a sibling acquires tab fallback loses this direct example.; does not reuse a sibling split pane pending spawn after remount — Remounted primary adopting its own pending PTY rather than the sibling spawn loses this direct example.; replays a stable-pane adoption without submitting the resume command — Stable-pane adoption replay preserving replay-before-live ordering and suppressing resume command loses this direct example.; forwards focus and hover reports without claiming a parked mirror (#26469) — Passive focus/hover forwarding without stealing mirror ownership, then intended Ctrl+C/click claiming, loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot\",\n        \"pnpm exec electron-vite build --mode e2e\",\n        \"pnpm run build:web-from-renderer\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n        \"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts\",\n        \"src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n        \"src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts\",\n        \"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\",\n        \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n        \"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts\",\n        \"src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts\",\n        \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n        \"src/main/ipc/ssh/ssh.test.ts\",\n        \"src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts\",\n        \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n        \"src/main/ssh/connection/ssh-connection.test.ts\",\n        \"src/preload/ssh-authority-forwarding.test.ts\",\n        \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n        \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n        \"src/shared/ssh-retained-payload-admission.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n          \"assertions\": [\n            \"a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts\",\n          \"assertions\": [\n            \"a stale web-mirror handle polls until a different ready handle is published without resubscribing the stale handle\",\n            \"replacement does not emit pane exit or disconnect callbacks and explicit terminal exit still retires the mirror\",\n            \"replacement polling and each in-flight request share a 15-second deadline, then accepted snapshots own recovery without input re-arming polling\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n          \"assertions\": [\n            \"recovery exposes connecting, recovering, backoff, connected, and fatal-offline phases with fenced epochs\",\n            \"ten partition cycles retain one PTY identity, reject detached input, and unsubscribe each epoch exactly once\",\n            \"automatic retries stop after one minute with no fatal error, no further requests, and no stale input\",\n            \"manual reconnect starts a new epoch, resubscribes the same PTY exactly once, and becomes healthy only after its snapshot\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts\",\n          \"assertions\": [\n            \"unknown terminal-create recovery stops all request activity after one minute without a fatal error, clips post-probe RPC timeouts to the remaining budget, then manual retry re-probes capability and reconciles the same mutation\",\n            \"an authoritative capability-probe failure replaces the stale connectivity error\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\",\n          \"assertions\": [\n            \"a stale create completion cannot replace or close a newer attachment, including when two runtimes use the same raw handle\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n          \"assertions\": [\n            \"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n          \"assertions\": [\n            \"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n          \"assertions\": [\n            \"one authenticated client/worktree mutation derives a stable server-owned terminal handle\",\n            \"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup\",\n            \"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning\",\n            \"in-flight mutation coordination is bounded and releases capacity after settlement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n          \"assertions\": [\n            \"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/connection/ssh-connection.test.ts\",\n          \"assertions\": [\n            \"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state\"\n          ]\n        },\n        {\n          \"file\": \"src/preload/ssh-authority-forwarding.test.ts\",\n          \"assertions\": [\n            \"full authority crosses Electron IPC without loss\",\n            \"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped\",\n            \"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/ssh-retained-payload-admission.test.ts\",\n          \"assertions\": [\n            \"retained connection states reject partial or malformed authority\",\n            \"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation\",\n            \"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n          \"assertions\": [\n            \"partial runtime authority is rejected through the captured subscription callback before environment state receives it\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n          \"assertions\": [\n            \"held replies from an old generation cannot replace a newer generation; failed full refresh preserves live state behind queued metadata\",\n            \"an unknown target triggers an authoritative list reread\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n          \"assertions\": [\n            \"a provider result becomes stale when same-ID repo ownership turns malformed or contradictory during the await\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n          \"assertions\": [\n            \"a StrictMode remount joins the pending spawn instead of starting a second one\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n          \"assertions\": [\n            \"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY\"\n          ]\n        }\n      ]",
        "Audit3077 reduces the IPC handoff suite while retaining the obsolete-reattach detach observer case and its alias. Removed nominal no-kill and gauge-cleanup alarms have no equivalent replacement.",
        "Audit3077 retires this complete dated receipt because its selected source was reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-28\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.48,\n          \"summary\": \"All 90 transport tests passed, including pre-publication admission rejection, handler-complete non-destructive detach for obsolete SSH reattach transports, settled retirement of rejected or destroyed fresh fallbacks, and reported shutdown refusal.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\"\n        }",
        "Audit3069 retires nominal spawn/resume/banner wiring, first-fit and lookup-budget variants, private pending-map checks, the split-CWD disposal suite and startup command/draft baseline variants. Distinct regression alarms are intentionally lost without equivalent replacement; retained ownership, cancellation and recovery cases remain. Existing selectors and dated evidence retain their original scope.",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/main/ssh/connection/ssh-connection.test.ts. Unresolved local/computed edges remain explicit debt. Retired active assertionRefs (raw original objects retained as historical only): {\n          \"file\": \"src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts\",\n          \"assertions\": [\"restores daemon terminal wake hints before declaring the session ready\"]\n        }",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/ssh/connection/ssh-connection-manager.test.ts: tears a failed startup down quietly, so its error is not replaced by a disconnect; marks a dial that never reached the host, so setup reports SSH’s reason; removes the registration when bulk teardown fails; leaves a connection whose own reconnect is asking the user alone; clears the pool entry when the closed connection is still the registered one; still reuses a connection that is already up; dials a user's connection test. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: ordinary registration cleanup removes only import { registerPtyConnectionStartupCwdFallbackNoticeTests } from '../startup/pty-connection-startup-cwd-fallback-notice.spec'; registerPtyConnectionStartupCwdFallbackNoticeTests(). src/renderer/src/components/terminal-pane/pty-connection/startup/pty-connection-startup-cwd-fallback-notice.spec.ts: prints a terminal notice when the startup cwd fell back to the workspace root. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
        "Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Current command covers store wake-hint metadata, main-process SSH provider failure semantics, provider attach/expired-attach behavior, and renderer deferred SSH reconnect/transient-failure/expired-relay fallback with mocked transports.",
        "The live SSH journey is environment-dependent and currently runs from a macOS Electron client against a Linux Docker host.",
        "Current Docker/Linux journeys prove one target's reconnect and cold-restore paths; live multi-target fanout, folder-workspace reconnect, and large-terminal-map timing remain untested.",
        "No paired-client close/non-interference journey was run for direct SSH reconnect; paired web clients intentionally remain outside coordinator ownership.",
        "WSL restore and direct SSH/WSL isolation remain inferred rather than directly covered.",
        "Linux and Windows desktop-client partition journeys using patched builds are not yet collected; the Windows smoke proves current reachability and PTY round-trip only.",
        "Terminal-create recovery depends on providers authoritatively listing live terminal handles and worktree ownership; older runtimes do not advertise the capability and are never retried after an unknown outcome.",
        "The test-value audit narrowed resolved-worktree-execution-host.test.ts to cache reuse and invalidation. Its direct hydrated-worktree, missing-folder, restored-owner, host-stamp and empty-runtime selection alarms are lost. Other routing and recovery suites do not establish equivalent selector coverage; historical run commands and results remain historical.",
        "The renderer scheduling fixture retains in-flight coalescing only. Its immediate publication and negative stale-SSH-cleanup call ledgers were removed; the retained SSH recovery evidence does not replace those alarms.",
        "The accepted-handle-events observer suite is removed, including its scoped listener and settlement-release assertions. These observer alarms are lost; retained SSH/transport journeys are not equivalent replacement coverage.",
        "The test-value audit removed repeated remote-handle rotation inventories and snapshot-first pending-restart migration examples from terminal-pty-identity-replacement.test.ts, plus direct foreground metadata setter, confirmation, evidence-enum, and prefix/worktree cleanup examples. Those rotation, pending-restart, snapshot-first migration, and foreground scalar-update alarms are lost. The retained replacement case observes pane and tab identities in one subscriber publication; it does not establish equivalent migration, process-evidence, or input-routing coverage. Historical commands and results remain historical.",
        "The test-value audit narrows terminals-hydration.test.ts to a real reconnect batch with one measured store publication and hydration-seeded history consumed by a subsequent visit/Back check. Direct split-layout, runtime/folder/floating restoration, dead-leaf focus, cold/known-absent SSH deferral, title, default-tab marker, navigation initialization, and hydrationSucceeded scalar examples are removed; those specific alarms are lost. No actual target-removal transition, live SSH connection, session writer, or persisted restart is exercised by the retained cases. The old target-scoped/snapshot assertion references are retired because the current file does not contain those oracles. Other suites and historical runs do not establish equivalent replacement coverage.",
        "Audit1299 removes tests/e2e/terminal-cold-activation-deferral.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
        "Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed.",
        "Audit1301 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-17\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 15,\n          \"summary\": \"Ten provider-contract files and 566 tests passed, including a shared 15-second polling/RPC deadline, no input-triggered re-polling after the bound, post-timeout snapshot recovery, listener cleanup, in-flight inventory deduplication, and replacement-state migration. Historical run: the ssh-startup-reconnect suite was later removed as mock forwarding coverage; its original command is preserved as history, not an active gate or replacement-equivalence claim.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\"\n        }",
        "Audit1301 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts\",\n    \"assertions\": [\n      \"concurrent callers share one pending inventory within the same runtime/worktree and share its original receipt; a post-operation inventory waits for older work before loading\"\n    ]\n  }\n]",
        "Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-21\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5,\n          \"summary\": \"Eleven fault-injection and recovery-UI files and 127 tests passed, covering suspended heartbeat clocks, stale socket, PTY, and create generations, canonical pre-ready close recovery with one replacement subscription, cold and repeated PTY reattachment, authoritative health, bounded PTY and terminal-create recovery, post-probe timeout clipping, manually retryable create cutoff, accurate capability-probe failures, same-PTY manual reconnect, pane-state cleanup, fatal error deduplication, stable create identity, cross-process PTY adoption, and fail-closed legacy inventory.\"\n        }",
        "Audit1342: src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts removed. Initial and event-triggered partial-authority hydration fixture alarms disappear. src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts removed. Multiline dedup/storm bounds, resource classification/collision, scoped clear/reconnect strip and1000-pane map count alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.3,\n          \"summary\": \"Two focused files and 26 tests passed, including pane-scoped rendering and recovery, sibling-error retention, split-close pane-id churn cleanup, current-transport multi-error clearing, dismissal re-admission, multi-line deduplication, and 8-message/24-line/4,000-character bounds.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts --reporter=dot\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.3,\n          \"summary\": \"Six direct-SSH files and 57 tests passed, including SSH tab bindings kept through connected pushes, disconnects and errors, partial-authority reconciliation, hydration, split-pane and detach contracts.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/components/terminal-pane/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"ssh\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts\",\n    \"assertions\": [\n      \"only the active pane's errors render and matching-pane recovery preserves sibling and unrelated messages\",\n      \"individual messages and the joined surface remain within 24 lines and 4,000 characters\",\n      \"a distinct error storm retains only the newest eight messages for one pane while whole-message dedup remains intact\",\n      \"repeated split-pane close churn releases every closed pane id while preserving the live sibling\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts\",\n    \"assertions\": [\n      \"connected pushes, disconnects, and errors keep an SSH tab's PTY binding; loss of contact is not exit\"\n    ]\n  }\n]",
        "Audit1396: src/renderer/src/components/terminal-pane/pty-connection-pending-spawn.spec.ts reduced. Lose standalone debug-state retention/log silence alarm. React StrictMode is not mounted; bindings manually simulate remount over mocked transport. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\",\"assertions\":[\"publishes pane and tab replacement identities in one store commit\"]},{\"file\":\"src/main/ipc/ssh/ssh.test.ts\",\"assertions\":[\"concurrent same-authority connects share one provider attempt\",\"authority rotation starts stale transport cancellation before teardown, concurrent fresh callers share one replacement, and stale completion cannot clobber the fresh session\",\"same-turn disconnect and forward-teardown failures across removal, reset, and terminate keep replacement connects and metadata mutation behind complete target cleanup\"]}]",
        "Audit1412: src/main/ssh/ssh-provider-authority.test.ts removed. Loses real AbortController revocation/target isolation/reentrancy outcomes, recreated-target generation-floor/session rollover behavior, stale mutation refusal and settled-registration cleanup alarms. These useful alarms are deliberately lost; no equivalent cancellation coverage is claimed. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/ssh/ssh-provider-authority.test.ts\",\"assertions\":[\"provider epoch and connection generation rotate as one exact authority pair\",\"provider resolution rejects stale or incomplete authority\",\"unknown-target currency probes reject without allocating provider authority state\"]}]",
        "Module-layout cleanup splits the former terminals-hydration suite into workspace-terminal-reconnect-hydration and workspace-navigation-history-hydration. The reconnect case retains daemon wake-hint/session-readiness outcomes; its store-publication count assertion is intentionally retired. The navigation case retains hydration-seeded visit/Back behavior. Historical receipts remain verbatim and do not validate these changed test owners.",
        "Audit1862 reduces remote-runtime-client-error-classification.test.ts by removing recoverable-code, authentication/protocol-negative and client-code blacklist inventories. Those direct classification alarms are lost; no equivalent replacement or actual retry behavior is claimed. Retained structured-code precedence and unstructured legacy normalization cases do not execute a remote connection. Socket-generation and socket-liveness sources in this selector are unchanged. Existing active receipts use unrelated selectors and remain unchanged; focused survivor execution does not validate the broad reconnect selector or physical platform/provider coverage.",
        "Audit1879 removes the standalone ASCII serving-detail length-cap example from ssh-retained-payload-admission.test.ts. That direct cap alarm is intentionally lost without equivalent replacement coverage. The three retained authority assertion references, commands and testFiles remain unchanged. Focused survivor execution is not new execution evidence for the broad SSH reattach gate or actual remote/platform behavior; existing receipts retain their original commands, results and counts.",
        "Audit1880 removes the entire mounted-terminal-scrollback.test.ts suite. Its direct fake-terminal scrollback option-assignment and repeated-value write-budget alarm is intentionally lost; no actual xterm output-retention or equivalent replacement coverage is claimed. Only its exact tokens in current commands and its testFiles entry are removed. Existing unrelated dated receipts, their raw objects and platform/provider accounting remain unchanged; they do not validate the reduced command selector.",
        "Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Exact lost direct alarms: 'detaches a rolled-back split surface without closing its PTY'; \"closes a tab through its last pane with the requester's reason, never an implied user close\"; 'uses non-destructive tab close semantics for the last rolled-back pane'; 'ignores a delayed rollback after the pane PTY identity changed'; 'retires a mounted rollback pane without detaching it as a movable surface'; 'retires mounted authority and binding while preserving the process and sleeping fence'; 'suppresses the pane PTY exit before intentional close teardown destroys the transport'; 'does not suppress natural PTY exits that already cleared the transport id'; 'moves chat mode only with its owning leaf %s'; 'creates a new terminal tab with the detached leaf layout and PTY id'; 'preserves the moved PTY shell override when the source uses %s'; 'syncs PTY ownership when the primary source pane is detached'; 'names the new tab as the client that already drew it did'; 'reports a refused move as a toast only for %s'; 'moves the detached tab into the requested group slot'; 'uses the live transport PTY id when the snapshot has not persisted it yet'; 'rejects a deferred split while inherited cwd is pending'; 'rejects a pending cwd even when the deferred marker is absent'; 'still rejects a deferred split after cwd resolves but before PTY bind'; 'carries resolved cwd when detaching an unbound non-deferred pane'; 'finds a same-worktree tab strip under overlay elements'; 'resolves the insertion slot from the hovered tab side'; 'ignores strips from another worktree'.",
        "Audit1903 historical retired assertion inventory; these are not current validated assertions. Complete original raw assertion objects follow verbatim:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/layout/detach/terminal-pane-tab-detach.test.ts\",\n          \"assertions\": [\n            \"a detached null-PTY leaf remains marked for pending activation before ownership transfer\"\n          ]\n        }",
        "Audit1925 (sources1922/1923): Delete the sole supplied public-SSH-state spread/sanitized-error projection and its provider-authority-pair alias. Also delete the complete tiny one-shot split-startup wrapper suite: callback-visible temporary field/reset, sequential payload and thrown-sentinel reset alarms disappear. No SSH provider epoch handoff, connection, process startup or actual terminal split was performed by either deleted suite. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'preserves the complete provider authority pair'; 'only exposes startup to the intentional split and clears it afterwards'; 'isolates startup payloads across sequential calls (setup then issue)'; 'clears startup even when splitPane throws'.",
        "Audit1925 historical original assertion object, preserved verbatim; removed aliases are retired, any surviving aliases remain limited to unchanged retained callbacks:\n{\n          \"file\": \"src/main/runtime/hosts/platform-probe/public-ssh-state.test.ts\",\n          \"assertions\": [\n            \"public SSH state preserves the complete provider epoch and connection generation pair\"\n          ]\n        }",
        "Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'detaches when the tab still owns the transport PTY'; 'detaches when a mirrored replacement tab owns the same PTY'; 'detaches when closeTab already owns provider shutdown for the removed tab'; 'destroys an ID-less transport so a pending spawn cannot outlive unmount'; 'detaches a removed automation pane after closeTab takes teardown authority'; 'consumes the queued initial cwd once when the ref is unset'; 'reuses the existing queued state without re-reading the store'; 'clears the one-shot cwd and restores the default cwd after the first pane'; 'leaves the cwd unchanged when no one-shot override is queued'; 'denies ownership to a split payload structurally identical to the queued command'; 'denies ownership when the tab queued nothing, so an unrelated pane cannot spend a slot'; 'withholds the consumer from a pane that does not own the queued command'.",
        "Audit1983: Delete the terminal-create idempotency forwarding suite and its prospective selector. Preserve2 unrelated receipts without claiming the lost forwarding alarm was replaced. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/TerminalRemoteRuntimeReconnectBanner.test.tsx src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal/terminal-create-idempotency.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\"",
        "Audit1983 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/terminal/terminal-create-idempotency.test.ts\"",
        "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed.",
        "Audit2195 removes the low-value startup admission boolean and host deferral predicate inventories from background-terminal-worktree-mount.test.ts. The reduced source retains concrete targeted mount, prune and reveal ownership transitions, not those oracle assertions. Existing selectors remain unexecuted here; no equivalent replacement or new runtime/provider/platform/budget result is claimed. Original retired assertion object verbatim:\n{\n          \"file\": \"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts\",\n          \"assertions\": [\n            \"startup waits for hydration before mounting terminal panes while degraded mode remains interactive\",\n            \"only an explicit local execution host can defer cold activation\",\n            \"SSH, remote-runtime, and unresolved owners remain eager\"\n          ]\n        }",
        "Audit2709 removes src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts: intentionally retire waiting out an older inventory and sharing a fresh post-operation request among concurrent callers. No equivalent replacement or fresh execution is claimed. Dated receipts remain historical evidence for their unchanged selectors only; they do not validate the reduced commands or full current gate. Original prospective command before removal: pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/web-session-tabs-sync/inventory/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts",
        "Audit3086: retire the destroyed fresh-session fallback settlement/non-destructive reattach alias and its direct selector; retain the detach/attach selector and assertion unchanged. The retained admission cases cover adopt-before-data and explicitly buffered-death admission without a new spawn, without replacing fallback retirement. July 28 evidence was already archived by audit3077; no duplicate retirement or new execution is claimed.",
        "Audit3096: remove the deleted reconnect-banner selector and its two UI aliases. The reduced recovery-state selector retains only the deadline cancelling pending backoff and explicit retry owning a new epoch alias; healthy-replacement stale-schedule and independent caller-cutoff cancellation aliases retire. Other retained state cases cover reentrant retry, owner settlement and same-epoch parked revival, without replacing those removed alarms. Prior admission-selector retirement, archived July 28 receipt, unrelated selectors/claims/receipts and old gaps remain unchanged; no fresh execution is claimed.",
        "Module-layout wave1 intentionally retires complete prohibited owning registrations in src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-attach-subscription.test.ts. Lost alarms: attaches to an existing remote runtime terminal handle; reports a rejected multiplex write through the pane recovery callback; does not report a rejected write from a superseded multiplex stream; does not report attachment health until the authoritative PTY snapshot arrives; drops its side-effect gauge from the census on %s; recovers when the first restored-terminal subscription attempt is offline; recovers when the runtime closes before a restored subscription becomes ready; surfaces a fatal error during subscription setup exactly once; reports viewer disconnect as an unverifiable remote exit; clears every retained transport error when the current stream becomes healthy. No equivalent replacement coverage or pass for a reduced selector is claimed. All unrelated selectors and historical receipts retain their original scope.",
        "Module-layout wave2 intentionally retires complete prohibited owning registrations in src/renderer/src/lib/resolved-worktree-execution-host.test.ts. Lost alarms: Both explicit and legacy workspace owners resolve to env-a initially. Replacing the repo catalog refreshes legacy ownership to env-b. A conflicting local repo row makes ownership ambiguous and returns null. Repeated unrelated updates perform zero id reads, an internal work-budget alarm removed. No equivalent replacement coverage or reduced-selector pass is claimed.",
        "Audit 3312 retires the ordinary six-pane distinct-live-handle reconnect/resubscription alarm from paired-reconnect-multi-pane-materialization.test.ts. The unchanged parked-pane activation/rematerialization case remains narrower and is not an equivalent replacement. The complete prior seven-contract macOS receipt is archived as historical evidence; it does not validate the reduced selector. No fresh socket, PTY, sleep/wake, provider, platform, mobile, mixed-version or rendered execution is claimed.",
        "Audit 3312 retires this complete dated seven-contract receipt because paired-reconnect-multi-pane-materialization.test.ts was reduced. Original command, currentCommand, result, counts, date and duration remain historical and do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.54,\n          \"summary\": \"Seven deterministic STA-3107 contracts passed across six-pane multiplex rematerialization and client-owned sidebar-row retention after sleep/wake.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/web-session-tabs-sync/agent-status/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot\"\n        }",
        "Audit3315 execution amendment: the reduced two-suite reconnect selector passed on Linux (2 cases). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only these two local deterministic unit cases, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS receipt remains archived verbatim.",
        "Audit 3318 reduces runtime-environment-ssh-state.test.ts, intentionally losing metadata membership-pruning/new-target-only-read and other-environment/local-bucket isolation alarms. Preserve generation/failed-full-refresh assertion and unknown-target authoritative-list reread; these narrower cases are not equivalent replacements. The unchanged active two-case Linux reconnect materialization/sidebar receipt and covered platform retain their exact scope and do not validate the reduced SSH state selector. Preserve unrelated SSH assertions, selectors and archived history. No fresh SSH discovery, provider/PTY/network, rendered, mobile, mixed-version, cross-platform or full-gate execution is claimed.",
        "Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: keeps a sidebar row for every still-live pane after a long sleep — Whole suite: 279 lines manually replay renderer ownership registry/status writes, snapshot patch/set, six-pane fixture inventory, and sidebar selectors/builders; expected pane IDs are production-computed. Does not run sleep/wake/transport or actual sidebar entry. Retires reconnect row-preservation assembly alarm.; still retires the regular TUI surface after an explicit terminal exit — Ordinary explicit-exit callback/map cleanup is repeated in the stale/new stream lifecycle case below. Retires separate regular-TUI baseline; keeper is not equivalent process/UI proof.; asks the HUB to recover an expired SSH pane and rebinds the host identity — Expired SSH owner error must ask the owning HUB to recover, then adopt fixed replacement handle, resubscribe and report rebind; actual transport dispatch and handle state prevent wrong-client recovery.; does not recover a pane whose relay reply was an identity mismatch — Identity mismatch means a different live PTY, so actual transport must surface refusal without recover/create, keeping original identity. Prevents destructive duplicate agent recovery.; fails closed when an older HUB cannot recover an expired SSH pane — Old HUB method_not_found is scripted mock refusal/error echo with no actual skewed host; repeats generic recovery failure propagation. Retires old-host recovery fallback refusal example.; names a held recovery's stopped WSL distro in readable copy, not the raw hold code — Pins exact WSL stopped-distro error prose after mock code; translation/copy assertion with no actual held recovery behavior. Retires readable-copy alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3326 retires this complete historical compound Linux unit receipt from active evidence because its paired-sidebar selector was removed. A fresh surviving-selector execution is required before restoring current evidence/platform credit. Original receipt verbatim:\n{\n          \"date\": \"2026-11-11\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/web-session-tabs-sync/agent-status/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/web-session-tabs-sync/agent-status/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.65,\n          \"summary\": \"Audit3315 focused candidate run: 2 suites / 2 deterministic unit cases passed for parked-pane reconnect materialization and client-owned sidebar retention. currentCommand names the same gate selector; executed command adds background launch and two-worker flags. This is local fake-runtime/store evidence only, not the complete gate, authenticated SSH/PTY/network, rendered Electron, provider, sleep/wake, mobile, mixed-version or cross-platform validation. Re-executed after rebasing onto main 1af64194a46d338777058c06954c2c8ee4a437be (candidate source commit 63adee8174d388466f9276a893972255cee06588).\"\n        }",
        "Audit3329 execution amendment: the reduced one-suite reconnect selector passed on Linux (1 case). Original source-review statements about no fresh execution describe the earlier static review; this new receipt validates only this one local deterministic unit case, not the complete gate or physical/runtime/rendered/provider/platform parity. Historical seven-case macOS and two-case Linux receipts remain archived verbatim.",
        "Audit3342 retires the complete client create-outcome identity/options/recovery suite and the malformed-or-contradictory repo-owner response matrix. Client replay identity, options, no-downgrade, quiescence/budget/manual retry, authoritative probe-error and malformed-owner refusal alarms are intentionally lost without equivalent replacement. Remaining repo-owner late catalog and old-host re-adoption boundaries do not replace them. The unrelated Linux paired-reconnect receipt stays verbatim with its original scope. Surviving selectors are unexecuted here; no fresh SSH/provider/process-deduplication, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3342 historical original commands object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\"",
        "Audit3342 historical original testFiles object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts\"",
        "Audit3342 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-outcome-recovery.test.ts\",\n          \"assertions\": [\n            \"unknown terminal-create recovery stops all request activity after one minute without a fatal error, clips post-probe RPC timeouts to the remaining budget, then manual retry re-probes capability and reconciles the same mutation\",\n            \"an authoritative capability-probe failure replaces the stale connectivity error\"\n          ]\n        }",
        "Audit3342 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n          \"assertions\": [\n            \"a provider result becomes stale when same-ID repo ownership turns malformed or contradictory during the await\"\n          ]\n        }",
        "Audit3359 retires whole host-surface-replacement and create-handoff suites, removing their compound unit command tokens, test-file entries and assertion references. Fake polling/deadline/subscription, supplied stale-handle ownership, close and replacement examples are intentionally lost without equivalent replacement. The unrelated Linux paired multi-pane reconnect receipt stays verbatim with its original scope. No fresh SSH/provider/network/PTY recovery, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\"",
        "Audit3359 historical original commands object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\"",
        "Audit3359 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts\"",
        "Audit3359 historical original testFiles object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\"",
        "Audit3359 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-host-surface-replacement.test.ts\",\n          \"assertions\": [\n            \"a stale web-mirror handle polls until a different ready handle is published without resubscribing the stale handle\",\n            \"replacement does not emit pane exit or disconnect callbacks and explicit terminal exit still retires the mirror\",\n            \"replacement polling and each in-flight request share a 15-second deadline, then accepted snapshots own recovery without input re-arming polling\"\n          ]\n        }",
        "Audit3359 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-create-handoff.test.ts\",\n          \"assertions\": [\n            \"a stale create completion cannot replace or close a newer attachment, including when two runtimes use the same raw handle\"\n          ]\n        }",
        "Audit3368 narrows stream-reconnect coverage to the actual ten synthetic transport epochs retaining one PTY identity, accepting and holding detached input for exactly-once later delivery, current decoded output and per-epoch subscription release. Prior rejection wording was inaccurate. Phase/backoff/cutoff/manual reconnect and parser/OSC/pause/retained-image/fatal/latch/claim/early-close alarms are intentionally lost without equivalent replacement. The Linux multi-pane reconnect receipt remains verbatim with its original scope; no fresh live SSH/provider/PTY/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3368 historical original assertionRefs object, preserved verbatim; retired claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n          \"assertions\": [\n            \"recovery exposes connecting, recovering, backoff, connected, and fatal-offline phases with fenced epochs\",\n            \"ten partition cycles retain one PTY identity, reject detached input, and unsubscribe each epoch exactly once\",\n            \"automatic retries stop after one minute with no fatal error, no further requests, and no stale input\",\n            \"manual reconnect starts a new epoch, resubscribes the same PTY exactly once, and becomes healthy only after its snapshot\"\n          ]\n        }",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ssh/connection/ssh-connection-manager.test.ts src/main/ssh/connection/ssh-connection.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts --reporter=dot\",\n        \"pnpm exec electron-vite build --mode e2e\",\n        \"pnpm run build:web-from-renderer\",\n        \"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n        \"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts\",\n        \"src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts\",\n        \"src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-expired-pane-recovery.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n        \"src/renderer/src/store/terminals/terminal-pty-identity-replacement.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts\",\n        \"src/shared/remote-runtime/control/remote-runtime-shared-control-socket-generation.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-client-error-classification.test.ts\",\n        \"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts\",\n        \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n        \"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts\",\n        \"src/renderer/src/store/slices/ui/workspace-navigation-history-hydration.test.ts\",\n        \"src/renderer/src/store/repos/repos-ssh-host-reconciliation.test.ts\",\n        \"src/main/ipc/ssh/ssh.test.ts\",\n        \"src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts\",\n        \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n        \"src/main/ssh/connection/ssh-connection.test.ts\",\n        \"src/preload/ssh-authority-forwarding.test.ts\",\n        \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n        \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n        \"src/shared/ssh-retained-payload-admission.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/paired-reconnect-multi-pane-materialization.test.ts\",\n          \"assertions\": [\n            \"a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n          \"assertions\": [\n            \"ten synthetic partition cycles retain one PTY identity, deliver each held detached input exactly once and release each epoch subscription exactly once; decoded live input/output remains current\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/recovery/remote-runtime-pty-recovery-state.test.ts\",\n          \"assertions\": [\n            \"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/remote-runtime-socket-liveness.test.ts\",\n          \"assertions\": [\n            \"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/terminal/launch/orca-runtime-terminal-create-idempotency.test.ts\",\n          \"assertions\": [\n            \"one authenticated client/worktree mutation derives a stable server-owned terminal handle\",\n            \"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup\",\n            \"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning\",\n            \"in-flight mutation coordination is bounded and releases capacity after settlement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/connection/ssh-connection-manager.test.ts\",\n          \"assertions\": [\n            \"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/connection/ssh-connection.test.ts\",\n          \"assertions\": [\n            \"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state\"\n          ]\n        },\n        {\n          \"file\": \"src/preload/ssh-authority-forwarding.test.ts\",\n          \"assertions\": [\n            \"full authority crosses Electron IPC without loss\",\n            \"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped\",\n            \"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/ssh-retained-payload-admission.test.ts\",\n          \"assertions\": [\n            \"retained connection states reject partial or malformed authority\",\n            \"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation\",\n            \"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/rpc/subscriptions/runtime-client-events.test.ts\",\n          \"assertions\": [\n            \"partial runtime authority is rejected through the captured subscription callback before environment state receives it\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/hosts/ssh/runtime-environment-ssh-state.test.ts\",\n          \"assertions\": [\n            \"held replies from an old generation cannot replace a newer generation; failed full refresh preserves live state behind queued metadata\",\n            \"an unknown target triggers an authoritative list reread\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts\",\n          \"assertions\": [\n            \"a StrictMode remount joins the pending spawn instead of starting a second one\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-detach-attach-handoff.test.ts\",\n          \"assertions\": [\n            \"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
    },
    {
      "id": "terminal-input.remote-write-rejection-recovery",
      "title": "Rejected paired-runtime terminal input remounts the pane",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "paired-runtime-stream-contract",
      "surfaces": [
        "terminal multiplex input",
        "legacy binary terminal input",
        "one-shot terminal.send fallback",
        "pane recovery",
        "pty:hasPty liveness routing"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["paired-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "No current automated execution oracle is claimed after Audit1417 retires the only passed receipt. Audit1417 intentionally deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: One end-to-end contract runs the real dispatcher, renderer multiplexer, remote transport, and pty-connection together and requires the tab remount, so the signal is proven past the transport callback it used to die behind. Focused contracts cover capability negotiation, legacy binary subscriptions, stream-id reuse, pane lifecycle reuse, the one-shot JSON fallback, and main refusing to answer liveness for a `remote:` id. Live headed/headless paired-runtime and mixed installed releases remain uncollected.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-2830",
        "https://github.com/stablyai/orca/issues/11124"
      ],
      "invariant": "When a paired-runtime client accepts terminal input locally but the authoritative host rejects the PTY write, a capability-compatible stream must notify only that current pane generation and that notification must end in an actual tab remount — no local liveness probe may veto it, because main owns no registry entry for a `remote:` id and must answer unknown for one. A host must never send the new opcode to a legacy or un-negotiated client, and a late rejection must never recover a replacement stream or pane lifecycle.",
      "oracle": "No current automated execution oracle is claimed after Audit1417 retires the only passed receipt. Historical pre-audit oracle account for changed sources: Wire the real dispatcher to the real renderer multiplexer, remote transport, and pty-connection over one bridged subscription; type into the pane, reject the authoritative runtime send before any process write, and require both the WriteUnavailable frame and a remountTerminalTabForRecovery call — repeated for every answer main can produce for a `remote:` id (fabricated dead, unknown, thrown). Separately: require one frame only for a capability-declaring client by driving an un-negotiated legacy binary subscriber first and a capable one second on the same runtime, so the capable frame proves the rejection had already been processed for both. Reuse the stream id before releasing a held rejection and require no signal; replace the stream or detach and reattach the same handle before releasing held failures and require no stale recovery. Require pty:hasPty to answer null for a `remote:` id without consulting the local provider.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. focused paired-runtime host and renderer contracts plus the end-to-end remount chain"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "No current automated execution oracle is claimed after Audit1417 retires the only passed receipt. No fresh changed-selector soak result. Historical account: Deterministic controlled-promise tests pass locally; CI and soak history have not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "No current automated execution oracle is claimed after Audit1417 retires the only passed receipt. No fresh red/green result for changed selectors. Historical account: On origin/main e5f49e0e1d, the test-only dispatcher oracle subscribed, accepted client input, invoked the authoritative host send once, recorded no process write, and failed only because no WriteUnavailable frame returned. The end-to-end contract was then red at the last hop on the delivery-only implementation — the host frame arrived and no remount followed — for all three liveness answers (3 failed / 0 passed), and green after the recovery routing fix (3 passed). Deleting the legacy-binary capability gate makes terminal-multiplex red (1 failed / 62 passed); deleting the pty:hasPty `remote:` guard makes the main contract red with the fabricated `false`; reverting either half of the renderer routing makes the end-to-end contract red (3 failed). Every mutation was restored by re-applying the edit and re-verified green."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical pre-audit selector account; changed selectors have no new measurement. The change adds one optional capability field, one constant-time outcome classification per existing write, and one rejection-only frame/callback. The recovery routing adds one string comparison per rejection and removes an IPC round-trip on that path; the pty:hasPty guard is a prefix test that short-circuits a provider lookup. It adds no polling, timer, provider listing, subprocess, retained payload, or cross-pane fanout."
      },
      "promotionCriteria": [
        "Collect headed and headless paired-runtime journeys with a rejected host write.",
        "Collect mixed installed-release evidence in both client/server directions.",
        "Collect CI soak history with no unexplained flakes."
      ],
      "knownGaps": [
        "Live headed and headless paired-runtime journeys are not collected.",
        "Linux, Windows, mobile, and mixed installed-release runs are not collected.",
        "Dead-record connected-state correction remains tracked separately in STA-2896.",
        "Audit1417 intentionally deletes src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts: Loses delayed credit until parsing, malformed frame/unknown stream handling, discarded transformed output recovery and failed ACK rearm alarms. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1417 retires this complete dated receipt because its selector contains a deleted source. The shortened selector has no fresh result. Original receipt verbatim:\n{\n          \"date\": \"2026-08-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts src/main/ipc/pty-session-liveness-and-ownership.test.ts --reporter=dot\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts src/main/ipc/pty/pty-session-liveness-and-ownership.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 15,\n          \"summary\": \"678 passed / 0 failed with the end-to-end remount contract, the un-negotiated legacy binary gate, and the pty:hasPty liveness-routing contract added.\"\n        }",
        "Audit1417 historical active selectors and assertion inventory: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts src/main/ipc/pty/pty-session-liveness-and-ownership.test.ts --reporter=dot\"],\"testFiles\":[\"src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts\",\"src/renderer/src/runtime/runtime-terminal-stream.test.ts\",\"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts\",\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts\",\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts\",\"tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts\",\"src/main/ipc/pty/pty-session-liveness-and-ownership.test.ts\"],\"assertionRefs\":[{\"file\":\"src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts\",\"assertions\":[\"rejected authoritative input emits WriteUnavailable only for capable multiplex and legacy binary clients\",\"an un-negotiated legacy binary subscriber never receives the rejection opcode\",\"a late rejection cannot target a replacement stream with the same id\"]},{\"file\":\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts\",\"assertions\":[\"WriteUnavailable reaches the current pane recovery callback without a fatal error\"]},{\"file\":\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts\",\"assertions\":[\"superseded streams and same-handle pane lifecycles ignore delayed rejections\",\"a rejected one-shot runtime fallback invokes pane recovery\"]},{\"file\":\"tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts\",\"assertions\":[\"a host-rejected write travels dispatcher to multiplexer to transport to pty-connection and remounts the tab\",\"no answer the local liveness probe can give for a `remote:` id blocks that remount\"]},{\"file\":\"src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts\",\"assertions\":[\"input-rejected-by-host recovery consults no liveness probe\",\"input-rejected-by-host still coalesces under the shared recovery cooldown\"]},{\"file\":\"src/main/ipc/pty/pty-session-liveness-and-ownership.test.ts\",\"assertions\":[\"pty:hasPty answers unknown for a paired-runtime handle instead of the local provider's fabricated dead\"]}]}. Historical platform/provider scope: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"paired-runtime\"]}"
      ],
      "demotionRule": "Keep experimental or demote if rejected input can remain silent, the signal stops short of a remount, a legacy or un-negotiated client receives an unknown opcode, a liveness probe fabricates an answer for a `remote:` id, a stale failure recovers a replacement pane, or the deterministic contract flakes without an identified product or harness bug."
    },
    {
      "id": "terminal-provider.wsl-restore-contract",
      "title": "WSL terminals preserve launch identity, liveness, and restore boundaries",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-provider",
      "layer": "windows-provider-contract",
      "surfaces": [
        "WSL",
        "Windows host boundary",
        "cwd identity",
        "startup command",
        "provider liveness",
        "restore"
      ],
      "platforms": ["windows"],
      "providers": ["wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6801",
        "https://github.com/stablyai/orca/pull/6830",
        "https://github.com/stablyai/orca/pull/6866",
        "https://github.com/stablyai/orca/pull/6951"
      ],
      "invariant": "WSL terminal restore must preserve Windows-host and Linux-guest path/cwd identity, shell launch args, startup command delivery, provider liveness semantics, and saved session ownership without being treated as ordinary local Windows ConPTY or generic SSH.",
      "oracle": "No executable slice yet. Promotion needs a Windows provider contract plus one focused live WSL smoke proving cwd/path mapping, shell echo, startup command delivery, targeted liveness unknown handling, and restore without duplicate panes or destructive false-dead cleanup.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Windows WSL provider contract plus focused live smoke"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "WSL is split out from SSH/remote planning so it cannot be mistaken for covered provider behavior."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break evidence for path/cwd mapping, startup command delivery, liveness unknown handling, and restore ownership."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "WSL restore and liveness checks must avoid broad provider scans on typing, focus, switch, render, or resize hot paths."
      },
      "promotionCriteria": [
        "Start with deterministic provider contracts for path/cwd mapping and launch args.",
        "Add one focused Windows live WSL smoke after provider contracts are stable.",
        "Keep WSL separate from SSH and local ConPTY evidence in PR descriptions."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "No live Windows WSL CI evidence.",
        "No provider contract yet separates Windows host paths from Linux guest cwd identity."
      ],
      "demotionRule": "Cannot promote while WSL restore is inferred from SSH, local ConPTY, or remote-runtime gates."
    },
    {
      "id": "terminal-output.scrollback-replay-fifo",
      "title": "Replay, scrollback, and hidden-output restore preserve ordering and clear semantics",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit-provider-contract",
      "surfaces": [
        "snapshot replay",
        "scrollback restore",
        "hidden output",
        "metadata-only replay",
        "WebGL recovery"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap on main. The replay FIFO/burst coalescing product change and its tests exist only on the pending reliability stack; main still uses a single pendingReplayData slot. It registers here with its owning split PR.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7012",
        "https://github.com/stablyai/orca/pull/7054",
        "https://github.com/stablyai/orca/pull/6949"
      ],
      "invariant": "Multiple replay notifications, metadata-only eager replays, hidden-output restores, and WebGL recovery must preserve FIFO ordering, apply clear-before-replay only when intended, and never overlay stale bytes on newer terminal output.",
      "oracle": "The current executable slice injects overlapping replay notifications while async replay drains and asserts pre-parse coalescing, in-flight replay preservation, FIFO draining after xterm parsing starts, and bounded burst-tail coalescing. Metadata-only replay, hidden output chunks, live output interleaving, clear semantics, and stale-overlap checks remain promotion-scope gaps.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "renderer unit or provider-contract test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused remote replay tests now run locally; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Focused tests assert pre-parse replay coalescing, in-flight replay preservation, FIFO draining for multiple replay notifications accepted after xterm parsing starts, and bounded burst-tail coalescing that keeps the newest snapshot. Needs saved red/green evidence and broader clear/metadata/hidden-output cases before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Replay fixes must not add unbounded renderer parsing, hidden-pane wakeups, or retry loops."
      },
      "promotionCriteria": [
        "Extend deterministic multi-replay coverage before changing replay code.",
        "Prove metadata-only replay does not clear restored scrollback.",
        "Keep long-table/golden visual tests as supporting evidence, not the primary oracle."
      ],
      "knownGaps": [
        "No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
        "Current command covers remote replay overlap, in-flight preservation, FIFO ordering for multiple in-progress replay notifications, and bounded burst-tail coalescing only.",
        "Does not yet cover clearBeforeReplay metadata on the fresh main implementation.",
        "Does not yet cover hidden-output restore plus live-output interleaving."
      ],
      "demotionRule": "Cannot promote without ordered replay and clear-semantics assertions."
    },
    {
      "id": "terminal-input.ime-and-synthetic-forwarding",
      "title": "IME, native text, and synthetic input commit exactly once, do not leak preedit bytes, and pair every claimed press with one release",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-input",
      "layer": "renderer-unit-platform-soak",
      "surfaces": [
        "IME",
        "native text forwarding",
        "synthetic input",
        "paste",
        "keyboard bypass",
        "JIS yen"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": [],
      "coverageNotes": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts: Loses direct timestamp-formula assertion; no useful independent alarm in removed registration. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1361 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1301 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): This audit removes the browser native-keyboard fallback inventory case. Its empty-chord, absent-layout and no-op-subscription alarms are lost; retained native input evidence is not an equivalent replacement. Historical commands and results remain historical. Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, xterm preedit visibility and row-occlusion behavior, Electron/CDP preedit geometry, Electron/CDP live-PTY Sogou-style repros, and macOS renderer/main slices for Preview kitty commits and layout-native Option input. The Option slice covers complete CSI-u flag fields including lock state, repeat/release event types, authoritative committed associated text, native dead-key release suppression, functional-versus-printable numpad codes, press-pinned release identity, live keyup modifiers, pending-layout text fallback, atomic layout refresh, rapid in-focus input-source changes, stable native layout characters, and both native/web preload fallbacks. The standalone remote SnapshotStart metadata suite is removed. Its proven-zero, nonzero, absent-field and malformed-value propagation alarms are intentionally lost; retained daemon and preview consumer contracts do not establish equivalent remote projection coverage. Historical commands and results remain historical. Real Linux/Sogou OS IME automation, native Windows candidate-window placement, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps. The audit removes isolated candidate-anchor width, last-column, timer-ordering and detached-textarea examples. The retained deterministic fixtures do not observe a native candidate window or establish equivalent geometry coverage; separate Electron geometry evidence remains historical. The test-value audit removes the empty end-of-row/no-tail composition baseline from terminal-korean-midline-preedit-occlusion.spec.ts. The placeholder masking and measured row-tail occlusion registrations remain; they are not equivalent replacement coverage for the removed empty-tail alarm. No new execution or native IME evidence is claimed. Audit1301: src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts reduced. Dead-key/IME variants, Unicode/language inventories, numpad/CapsLock cases and other protocol samples lose their individual alarms. No equivalent replacement coverage is claimed. Audit1320: src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts reduced. Last-complete snapshot while layout-map/native-snapshot partial refresh settles loses its individual implementation-cache alarm. No equivalent replacement coverage is claimed. Audit1342: src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts reduced. Second Korean-layout replay, ordinary Korean/ASCII no-remap baselines and weak Option nonempty-byte alarm are dropped. No equivalent replacement coverage is claimed. Audit1361: src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts removed. Snapshot/live-proven kitty flags, replacement choice and replay idempotence in the assembled mirror. No equivalent replacement coverage is claimed. Audit1365: focused Linux unit selection passed on source head 8880357cb420c45f1b808ae545a5bc609324624d. This new result has its own exact command; historical results keep their prior scope. Intentional test losses remain recorded in knownGaps. No physical-provider, native input, rendered E2E, p95, soak or replacement-coverage claim. Audit1391: src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts reduced. Lose explicit one-read/unchanged-style work budget across 30 syllables and single-timer burst alarm. Synthetic screen bounds/terminal cursor bound retained proof to DOM anchor updates, not actual OS IME placement. src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts reduced. Lose explicit PC-101 alternate omission, multi-codepoint/control associated text filtering, lock modifier integer, shifted punctuation, standalone separator and printable nonfunctional keypad fallbacks. Retained pure encoding is a wire-contract check without host input delivery. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1396: src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts reduced. Lose standalone handled Ctrl, Shift+Space, shifted non-ASCII keydown and active-composition backspace/arrow/text/Process suppression alarms. No actual IME/PTY encoding occurs. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1402: src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts removed. Intentionally loses invalidation, focus/manual refresh gating and stale/newest generation settlement outcomes, including direct stale category suppression. No equivalent replacement or default preload input-source delivery claim. src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts removed. Intentionally loses substituted sentence punctuation, shifted/backslash/multi-unit/full-width/letter input and Kitty flag/release/report encoding alarms across14 authored registrations. No equivalent replacement or real pane/browser input delivery claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6699",
        "https://github.com/stablyai/orca/pull/6682",
        "https://github.com/stablyai/orca/pull/6513",
        "https://github.com/stablyai/orca/pull/6999",
        "https://github.com/stablyai/orca/issues/12545",
        "https://github.com/stablyai/orca/issues/12729",
        "https://github.com/stablyai/orca/pull/17170"
      ],
      "invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY. A live preedit must stay visible across an IME-resumed transaction, preserve every committed row-tail cell hidden by its opaque overlay, mask only a structurally verified Codex or Claude placeholder and never a row carrying typed text, keep the themed insertion caret and native candidate anchor inside the terminal at the final column, and clean up without stale overlay children or ownership classes. Layout-native Option text must preserve negotiated CSI-u alternate/associated fields and lock modifiers, distinguish repeat from press, and resolve releases with the press's primary identity plus the actual keyup modifiers without exposing a partial or stale layout refresh. An in-focus macOS input-source change must invalidate both renderer authorities before the next key can use the old source. When the snapshot source proves kitty state, macOS Preview commits must use the application's effective flags after the sequenced snapshot and every proven replay/live transition, and a claimed press delivered under report_event_types must produce exactly one matching release regardless of whether keyup arrives before or after insertText and regardless of xterm's defensive internal reset.",
      "oracle": "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, resumed Windows event traces reactivate the visible preedit, an opaque mid-line overlay reproduces the committed row tail it covers, arbitrary DIM output remains visible, and final-column layout keeps both caret and textarea candidate anchor within the available screen width. The retained candidate-anchor slice checks layout-read caching, deferred timer coalescing, recognized-screen follow-ups and refit refresh with deterministic DOM fixtures. A Codex frame whose prompt row is bold and whose dimmed model footer sits below a blank gap acquires the mask class while composing; the same placeholder text without that footer, a framed-versus-unframed Claude prompt, a row of arbitrary dimmed output, and a row carrying typed text do not. The class is gone after composition end, after a blur that is not followed by a session end, and after disposal. Rendered Electron/CDP geometry independently proves the overlay reproduces every committed cell it hides, that a real Codex placeholder at column 2 is masked rather than repeated, and that the final-column caret, preedit, and textarea right edges all land inside the screen. Input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and real fcitx4/Sogou captures send only the committed candidate for Space/digit picks while ordinary typing, literal Space and digits stay available. A main/preload/renderer notification chain proves every live window invalidates immediately, the old native read settles before a coalesced refresh signal, and older refreshes are generation-fenced. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text. Real legacy IME commit preservation, native candidate-window placement, and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts src/shared/terminal/input/terminal-composer-draft.test.ts src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts",
        "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
        "pnpm run test:e2e -- tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts",
        "pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts"
      ],
      "testFiles": [
        "tests/e2e/terminal-option-composed-ascii.spec.ts",
        "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts",
        "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts",
        "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts",
        "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts",
        "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts",
        "src/shared/terminal/input/terminal-composer-draft.test.ts",
        "src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts",
        "src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts",
        "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts",
        "src/preload/app-restart-checkpoint-routing.test.ts",
        "src/renderer/src/web/web-preload-api-ui.test.ts",
        "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
        "src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts",
        "src/main/ipc/terminal-preview-output-stream.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
        "tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts",
        "tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts",
          "assertions": [
            "real fcitx4 Sogou captures (GTK module and XIM) send only the committed candidate for Space and digit picks, under legacy keys and kitty flags 1 and 5",
            "a real fcitx4 Google Pinyin in-client preedit still commits through the composition path",
            "an XIM pick's code-less keydown pairs with its keyup so kitty event reporting sends one release per pick"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts",
          "assertions": ["A transaction inferred from update alone commits and cleans up."]
        },
        {
          "file": "tests/e2e/terminal-option-composed-ascii.spec.ts",
          "assertions": [
            "a live kitty-negotiated pane receives the Option-composed ASCII character, not the physical alt chord",
            "an Option layer that also needs Shift still reaches the pty as text",
            "configured Option-as-Alt still reports the layout-resolved physical chord",
            "a non-ASCII Option glyph still reaches the application as its alt hotkey"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts",
          "assertions": [
            "Autorepeat cannot replace the first release sender; a fresh press can replace an orphaned sender for the same key."
          ]
        },
        {
          "file": "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts",
          "assertions": [
            "rapid input-source changes coalesce to one latest-generation refresh signal"
          ]
        },
        {
          "file": "src/preload/app-restart-checkpoint-routing.test.ts",
          "assertions": [
            "macOS keyboard reads and the change subscription remain wired after main integration",
            "the two-phase change payload reaches the renderer unchanged",
            "the subscription disposer removes the exact IPC listener"
          ]
        },
        {
          "file": "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
          "assertions": [
            "the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output",
            "flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release",
            "both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes",
            "the release is emitted by the forwarder while xterm's internal kitty flags stay 0",
            "the mutable flags getter is read exactly once, at commit time, never on keydown or keyup",
            "auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one"
          ]
        },
        {
          "file": "src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts",
          "assertions": [
            "a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback",
            "restoreSnapshotFlags proves only the active screen",
            "provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0"
          ]
        },
        {
          "file": "src/main/ipc/terminal-preview-output-stream.test.ts",
          "assertions": [
            "a partially covered sequenced chunk retains exactly its unseen suffix in live mode",
            "a transformed overlap remains unsliced in replay mode"
          ]
        },
        {
          "file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
          "assertions": [
            "Sogou-style Space candidate selection submits only the committed Chinese character",
            "Sogou-style digit candidate selection submits only the committed Chinese phrase",
            "Post-composition Sogou-style digit selection stays out of the PTY after compositionend",
            "Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap"
          ]
        },
        {
          "file": "tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts",
          "assertions": [
            "the rendered final-column preedit caret remains inside the terminal screen",
            "a rendered full-width Korean preedit spans materially more than the one terminal cell reported in #12729"
          ]
        },
        {
          "file": "tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts",
          "assertions": [
            "the rendered opaque overlay reproduces every committed row-tail cell its measured rectangle hides",
            "a real Codex placeholder with bold prompt, blank footer gap, model footer, and cursor at column 2 stays masked"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-10-13",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-fcitx4-trace-replay.test.ts",
          "result": "passed",
          "durationSeconds": 1.99,
          "summary": "1 replay test file and 37 tests passed on macOS: real fcitx4 Sogou (GTK module and XIM) and Google Pinyin captures through the full Linux pane keyboard stack under legacy keys and kitty flags 1 and 5, plus XIM release pairing under kitty flags 3. The same captures were also replayed with real fcitx4 + Sogou in an Ubuntu 22.04 container, with every scenario sending only the committed text.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1361; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1320; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1301; any retained unchanged-source receipts apply only to their own commands. Historical account: Focused renderer input tests and the Electron/CDP Sogou-style repro are now registered; needs soak history and true platform IME evidence before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1361 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1320 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1301 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, live-PTY Sogou-style candidate commits, and the Preview kitty slice (press/release pairing in both keyup orderings, and snapshot flag provenance separating a proven 0 from an absent field). Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Terminal input hot-path audit clean through 2026-08-29: candidate guards retain O(1) checks and bounded per-pane state. Xterm overlay reconciliation scans only the current row, bounded by terminal columns, retains at most three current DOM children, reuses one preedit-bounds layout read for the visual geometry and the textarea the OS samples, and cancels its single deferred timer on replacement and disposal. The candidate anchor adds no layout read of its own: it clamps from the inline width xterm just wrote. Orca's placeholder binding reads the bounded visible cursor context at composition start and on xterm render only while a session is active, retaining one active session id and one disposable render listener. Layout changes add one process-lifetime native listener, two singleton renderer subscriptions, one O(live windows) broadcast per OS event, and generation-fenced refreshes whose native helper read is deduplicated in flight. The paths are event-driven and add no polling, per-key IPC, SSH/remote transport work, unbounded queues, or retained terminal data."
      },
      "promotionCriteria": [
        "Cover deterministic byte/cell oracles first.",
        "Mark true OS IME automation gaps explicitly by platform.",
        "Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts, src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT65 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts src/shared/terminal/input/terminal-composer-draft.test.ts src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts\",\n        \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n        \"pnpm run test:e2e -- tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n        \"pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts\"\n      ]\ntestFiles: [\n        \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n        \"src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts\",\n        \"src/shared/terminal/input/terminal-composer-draft.test.ts\",\n        \"src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n        \"src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts\",\n        \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n        \"src/preload/app-restart-checkpoint-routing.test.ts\",\n        \"src/renderer/src/web/web-preload-api-ui.test.ts\",\n        \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n        \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n        \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n        \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n        \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n        \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n          \"assertions\": [\n            \"real fcitx4 Sogou captures (GTK module and XIM) send only the committed candidate for Space and digit picks, under legacy keys and kitty flags 1 and 5\",\n            \"a real fcitx4 Google Pinyin in-client preedit still commits through the composition path\",\n            \"an XIM pick's code-less keydown pairs with its keyup so kitty event reporting sends one release per pick\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts\",\n          \"assertions\": [\n            \"With supplied geometry, competing xterm render and Orca clamp preserve final-cell caret/candidate anchor positions.\",\n            \"Actual xterm buffer repaint updates the row tail while the preedit remains open.\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n          \"assertions\": [\"A transaction inferred from update alone commits and cleans up.\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n          \"assertions\": [\n            \"a live kitty-negotiated pane receives the Option-composed ASCII character, not the physical alt chord\",\n            \"an Option layer that also needs Shift still reaches the pty as text\",\n            \"configured Option-as-Alt still reports the layout-resolved physical chord\",\n            \"a non-ASCII Option glyph still reaches the application as its alt hotkey\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n          \"assertions\": [\n            \"Autorepeat cannot replace the first release sender; a fresh press can replace an orphaned sender for the same key.\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n          \"assertions\": [\n            \"rapid input-source changes coalesce to one latest-generation refresh signal\"\n          ]\n        },\n        {\n          \"file\": \"src/preload/app-restart-checkpoint-routing.test.ts\",\n          \"assertions\": [\n            \"macOS keyboard reads and the change subscription remain wired after main integration\",\n            \"the two-phase change payload reaches the renderer unchanged\",\n            \"the subscription disposer removes the exact IPC listener\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n          \"assertions\": [\n            \"the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output\",\n            \"flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release\",\n            \"both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes\",\n            \"the release is emitted by the forwarder while xterm's internal kitty flags stay 0\",\n            \"the mutable flags getter is read exactly once, at commit time, never on keydown or keyup\",\n            \"auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n          \"assertions\": [\n            \"the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n          \"assertions\": [\n            \"a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback\",\n            \"restoreSnapshotFlags proves only the active screen\",\n            \"provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n          \"assertions\": [\n            \"a partially covered sequenced chunk retains exactly its unseen suffix in live mode\",\n            \"a transformed overlap remains unsliced in replay mode\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n          \"assertions\": [\n            \"Sogou-style Space candidate selection submits only the committed Chinese character\",\n            \"Sogou-style digit candidate selection submits only the committed Chinese phrase\",\n            \"Post-composition Sogou-style digit selection stays out of the PTY after compositionend\",\n            \"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n          \"assertions\": [\n            \"the rendered final-column preedit caret remains inside the terminal screen\",\n            \"a rendered full-width Korean preedit spans materially more than the one terminal cell reported in #12729\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n          \"assertions\": [\n            \"the rendered opaque overlay reproduces every committed row-tail cell its measured rectangle hides\",\n            \"a real Codex placeholder with bold prompt, blank footer gap, model footer, and cursor at column 2 stays masked\"\n          ]\n        }\n      ]",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 66,\n          \"summary\": \"Four live-Electron scenarios passed against a real pty whose kitty flags were armed by the application's own CSI > 1 u: Option-composed `@` and Option+Shift-composed `\\\\` arrive as text with no alt chord, configured Option-as-Alt still reports the layout-resolved chord, and a non-ASCII Option glyph still reaches the application as its alt hotkey. Discrimination was proven by mutation rather than assumed — restoring the pre-fix policy makes exactly the two composed-text scenarios fail with the character never reaching the pty, while both chord scenarios stay green.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 13.9,\n          \"summary\": \"The Electron live-PTY IME gate passed three scenarios covering Windows IME Shift commit, candidate-selector suppression with committed Chinese text, and composed text/cursor/Backspace stability; the opt-in real-agent scenario remained skipped.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-11\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 30.3,\n          \"summary\": \"Debian 12 arm64 Docker with Node 24 and Xvfb passed both live Electron/PTY IME scenarios; the orphaned-letter-keyup candidate digit submitted no selector byte, and the real-Codex opt-in scenario was skipped.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 72,\n          \"summary\": \"Electron/CDP IME repro passed: Sogou candidate selection, post-composition candidate selection, and existing Chinese IME harness passed; real Codex IME test was skipped behind ORCA_E2E_REAL_CODEX_IME.\"\n        }",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: tests/e2e/terminal-option-composed-ascii.spec.ts: still reports the Alt chord when Option is configured as Alt. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting tests/e2e/terminal-option-composed-ascii.spec.ts remains historical and is not a passing result for the reduced current command.",
        "Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
        "Textarea geometry is a deterministic lower-layer oracle for native candidate placement; no automated run observes the operating system's candidate window itself.",
        "Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage.",
        "An older remote host omits the optional SnapshotStart kitty field, so a new client falls back to raw commits until live negotiation is observed.",
        "Snapshot authorities expose only the active screen's effective flags, not kitty's complete two-screen push stacks; a pop that crosses the restored boundary degrades to unknown rather than a proven value.",
        "The audit removes isolated candidate-anchor width, last-column, timer-ordering and detached-textarea examples. The retained deterministic fixtures do not observe a native candidate window or establish equivalent geometry coverage; separate Electron geometry evidence remains historical.",
        "The test-value audit removes the empty end-of-row/no-tail composition baseline from terminal-korean-midline-preedit-occlusion.spec.ts. The placeholder masking and measured row-tail occlusion registrations remain; they are not equivalent replacement coverage for the removed empty-tail alarm. No new execution or native IME evidence is claimed.",
        "Audit1301: src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts reduced. Dead-key/IME variants, Unicode/language inventories, numpad/CapsLock cases and other protocol samples lose their individual alarms. No equivalent replacement coverage is claimed.",
        "Audit1301 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts src/main/ipc/macos-keyboard-layout-snapshot.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.8,\n          \"summary\": \"The deterministic Option/layout slice passed exact protocol bytes for filtered committed associated text, physical and alternate key identities, functional and printable numpad keys, press-pinned releases across layout and lock changes, lock modifiers, layout-aware configured Alt across individual flags and dead keys, terminal-engine-owned global legacy handling, IME-owned DOM events, ISO/Space keys, native dead-key release suppression, pending-layout text fallback, release ownership, the two-phase native-read barrier, synchronous cache invalidation, rapid-change coalescing, generation fencing, every-live-window fanout, cleanup, and native/web platform fallbacks.\"\n        }",
        "Audit1301 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts\",\n    \"assertions\": [\n      \"native Option-composed ASCII remains text outside report-all mode while configured-Alt sides remain chords\",\n      \"pending shifted-layout data fails safe to composed text while configured-Alt ownership remains authoritative\",\n      \"dead, Process, Unidentified, composing, and keyCode-229 events stay with composition\",\n      \"configured Alt-side dead keys retain legacy chords while other IME-owned events stay with composition\",\n      \"policy-owned configured Alt uses the active layout, preserves engine-owned global legacy and form-only legacy encoding, and omits associated text\",\n      \"report-all uses layout primary/shifted identities plus committed text for ISO and Space keys\"\n    ]\n  }\n]",
        "Audit1320: src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts reduced. Last-complete snapshot while layout-map/native-snapshot partial refresh settles loses its individual implementation-cache alarm. No equivalent replacement coverage is claimed.",
        "Audit1320 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts\",\n    \"assertions\": [\n      \"complete native layout characters replace atomically while input continues using the prior complete snapshot\",\n      \"native and browser layout sources from separate transactions are never combined\",\n      \"an input-source notification clears stale characters synchronously and fences the older refresh\"\n    ]\n  }\n]",
        "Audit1342: src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts reduced. Second Korean-layout replay, ordinary Korean/ASCII no-remap baselines and weak Option nonempty-byte alarm are dropped. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-09\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.7,\n          \"summary\": \"8 test file(s) passed, 143 tests, after adding the OS key-binding substitution replay. Discrimination checked by mutation rather than assumed: suppressing the structural claim, and separately removing the single character the older punctuation table happened to list, each make the replay send the raw layout character while both paired negatives stay green.\"\n        }",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-07\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.7,\n          \"summary\": \"7 test file(s) passed, 144 tests passed on the Linux/Sogou candidate-key branch (includes held-key repeat guard coverage). The command shown is the gate's current one, which the manifest check requires; the run itself predates two of the files it now lists. The 2026-08-09 entry is the one that covers the current slice.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n    \"assertions\": [\n      \"an OS key-binding substitution reaches the PTY instead of the raw layout character\",\n      \"the same key with no substitution in play still sends the layout character\"\n    ]\n  }\n]",
        "Audit1361: src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts removed. Snapshot/live-proven kitty flags, replacement choice and replay idempotence in the assembled mirror. No equivalent replacement coverage is claimed.",
        "Audit1361 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-16\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/main/daemon/daemon-pty-adapter.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.3,\n          \"summary\": \"9 test files and 172 tests passed, covering the Preview kitty slice: real forwarder bytes at snapshot-proven flags, press/release pairing across both keyup/insertText orderings, native and configured-side dead-key release ownership, and flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts — asserted on the daemon snapshot and on a host-pushed remote snapshot that carries the flags with their sequence. The emitter-side rule that a remote SnapshotStart withholds flags without a seq has no direct assertion yet; the client-side gate is what these files pin.\"\n        }",
        "Audit1361 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1361 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts\",\n    \"assertions\": [\n      \"a Preview opened on a snapshot carrying flags 8 adopts 8 before any live output\",\n      \"a replacement snapshot whose ANSI carries no kitty bytes keeps its proven flags, and a proven 0 clears an earlier 8\",\n      \"a missing field leaves the mirror unproven at the raw-text fallback and a later live negotiation still upgrades it\",\n      \"restored flags land on the screen the snapshot scan selected\",\n      \"a proven post-snapshot suffix advances the stack while redelivered bytes apply idempotently\"\n    ]\n  }\n]",
        "Audit1391: src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts reduced. Lose explicit one-read/unchanged-style work budget across 30 syllables and single-timer burst alarm. Synthetic screen bounds/terminal cursor bound retained proof to DOM anchor updates, not actual OS IME placement. src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts reduced. Lose explicit PC-101 alternate omission, multi-codepoint/control associated text filtering, lock modifier integer, shifted punctuation, standalone separator and printable nonfunctional keypad fallbacks. Retained pure encoding is a wire-contract check without host input delivery. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts\",\"assertions\":[\"keeps forced layout at one read per composition across a Hangul burst\",\"coalesces the deferred Cursor Agent re-apply to one timer per burst\",\"keeps typed follow-ups anchored after recognizing the initial Cursor Agent screen\",\"refreshes the deferred metrics and anchor after a refit\"]},{\"file\":\"src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts\",\"assertions\":[\"report-all Option events encode exact alternate, repeat, release, and associated-text fields\",\"report-all native commits preserve unresolved layout characters and distinguish functional from printable numpad identities\",\"associated text omits forbidden control codepoints\",\"release events omit associated text and sparse PC-101 alternates retain their parameter position\",\"CapsLock and NumLock occupy their protocol modifier bits\"]}]",
        "Audit1396: src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts reduced. Lose standalone handled Ctrl, Shift+Space, shifted non-ASCII keydown and active-composition backspace/arrow/text/Process suppression alarms. No actual IME/PTY encoding occurs. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts\",\"assertions\":[\"macOS standalone Process key behavior and composition-owned key suppression stay intact\"]}]",
        "Audit1402: src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts removed. Intentionally loses invalidation, focus/manual refresh gating and stale/newest generation settlement outcomes, including direct stale category suppression. No equivalent replacement or default preload input-source delivery claim. src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts removed. Intentionally loses substituted sentence punctuation, shifted/backslash/multi-unit/full-width/letter input and Kitty flag/release/report encoding alarms across14 authored registrations. No equivalent replacement or real pane/browser input delivery claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts\",\"assertions\":[\"synthetic and native input-source paths are classified for covered fixtures\",\"report-all commits retain the unshifted physical key while associated text carries the committed substitution\"]},{\"file\":\"src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts\",\"assertions\":[\"a stale asynchronous input-source probe cannot overwrite the newest classification\",\"an input-source notification changes the classification to unknown synchronously before refreshing\"]}]",
        "Audit1417 intentionally reduces src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts: Loses direct timestamp-formula assertion; no useful independent alarm in removed registration. No equivalent replacement coverage or fresh result is claimed.",
        "Audit1876 removes the standalone native keyboard snapshot parser suite, direct input-source invalidation/fanout, quit/native teardown and non-macOS subscription examples, and preview-output fully covered/newer/missing-metadata/unsequenced examples. Those direct alarms are intentionally lost without equivalent replacement coverage. Retained notification cases exercise latest-generation coalescing; retained preview cases exercise only partial sequenced suffix slicing and transformed-overlap replay. Existing native/E2E/trace receipts keep their original commands, results and counts; focused survivor runs do not validate the broad IME selector or physical native/platform behavior.",
        "Audit1878 removes the direct non-negative safe-integer snapshot-flags validator table from terminal-kitty-keyboard-mode-tracker.test.ts. Active-screen proof and known-zero/provenance state tests remain, without equivalent replacement coverage or a new whole-gate result. Existing dated receipts retain their original source scope.",
        "Audit1888 removes the entire candidate-key-release-guard and composition-tracker suites. Direct candidate predicate/map, held-repeat, expiry, changed-modifier and overlapping-release alarms, plus composition active/stale/trailing-guard/reset alarms, are intentionally lost. It reduces placeholder-mask: frame/lookalike/stock-draft inventories and simple end/dispose cleanup alarms are lost; real xterm draft visibility, blur without end/repaint, live reclassification and newest-session ownership remain. Native-text-forwarder loses structural claim, direct forwarding/encoding inventories, early-keyup/modifier/tombstone/transaction/disposal examples; only NumLock press-pinned release identity, swallowed-repeat release obligation and negotiation-pop suppression remain. The standalone Mac remap expected-text case is removed; captured remap plus an explicitly DERIVED neighbour remains. Four pre-audit assertionRefs are retired below as historical inventory, with no equivalent replacement claim. Retained tests use simulated events, flags, frames and transport; this is not native IME/substitution, real host/PTY, focus, soak or measured-budget validation. All five active IME receipts remain raw unchanged because their exact selectors are unaffected: four Electron receipts and the byte-exact unchanged fcitx4 replay suite/currentCommand. Other active selectors/assertions, coverage/maturity accounting, and all prior notes remain unchanged.",
        "Audit1888 historical assertion inventory for removed/reduced suites; not current validated assertions. Original raw assertion objects follow:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-candidate-key-release-guard.test.ts\",\n          \"assertions\": [\n            \"suppressed candidate keydown arms only the matching keypress/keyup release guard\",\n            \"held-key repeat keydowns stay guarded until their keyup, even past expiry\",\n            \"fresh keydowns, other keys, modified keys, and expired keypresses are not guarded, and a fresh press drops a stale pending release\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composition-tracker.test.ts\",\n          \"assertions\": [\n            \"empty Sogou-style compositionupdate keeps composition active\",\n            \"stale composition state expires so editing keys cannot stay suppressed indefinitely\",\n            \"post-composition candidate guard is armed only by Sogou-style empty updates and clears after real typing\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts\",\n          \"assertions\": [\n            \"a bold Codex prompt row with a dimmed model footer below a blank gap, and a framed Claude prompt, acquire the mask class only while composing\",\n            \"the same placeholder text without its footer or frame, and arbitrary dimmed output, acquire nothing\",\n            \"a row carrying typed text acquires no mask even while the stock placeholder is still rendered to its right\",\n            \"the class is gone after composition end, after a blur with no session end behind it, and after disposal\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts\",\n          \"assertions\": [\n            \"native text commits route once to the intended PTY\",\n            \"composition/preedit bookkeeping does not leak premature text\",\n            \"multi-codepoint committed text is reported independently from physical key identity\"\n          ]\n        }",
        "Audit1896 removes the entire synthetic local-echo trailing-preedit suite, CSI-u encoding table, Option-compose scalar policy, non-Mac/Mac bypass matrices and runtime-prefix projection suite. Their direct overlay, scalar key/flag encoding, bypass/suppression and environment-projection alarms are intentionally lost. The removed paste-runtime suite only projects supplied PTY-prefix/runtime-environment values; runtime-environment selection does not validate payload forwarding or deduplication. Its retired duplicate-payload assertion overstated that test and is preserved verbatim only as historical inventory. It reduces midline-preedit-tail to competing final-cell caret/candidate anchor owners with supplied geometry and actual xterm buffer repaint under an open preedit: arbitrary dimmed-output, simple cleanup, other row-tail/style inventories and nearby geometry cases are lost. Resumed-preedit-visibility retains only commit/cleanup of an update-inferred transaction; recorded/ordinary-neighbour reactivation examples are removed. Option-kitty-release retains only first-sender ownership across autorepeat versus fresh-press replacement of an orphaned owner: live modifier/layout/NumLock identity, native dead-key and negotiation/mode-pop inventories are lost. Three complete assertionRefs are retired and three narrowed; all six prior raw objects are archived below as historical inventory. Tests use synthetic DOM events, supplied geometry/state and callback/transport sinks, with no native IME/keyboard, current device, real PTY, ConPTY, remote runtime, focus/app, soak or measured-budget validation. No equivalent replacement is claimed. All five active IME receipts retain exact unaffected selectors and raw objects; all230 current receipts, prior knownGap literals and unrelated accounting/fields are preserved. This note records scope loss only and promotes no new execution evidence.",
        "Audit1896 historical assertion inventory for three retired and three narrowed refs; not current validated assertions. Original raw assertion objects follow:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-trailing-preedit-occlusion.test.ts\",\n          \"assertions\": [\n            \"rolling Korean input keeps only the uncommitted trailing syllable in the themed overlay\",\n            \"the overlay remains anchored to the live cursor cell and clears after commit\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/keyboard/xterm-bypass-policy-non-mac.test.ts\",\n          \"assertions\": [\n            \"standalone Linux 229 keydowns reach xterm while Windows 229 keydowns stay suppressed\",\n            \"candidate Space/digit selectors are suppressed only while candidate guards are active\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/paste/terminal-paste-runtime.test.ts\",\n          \"assertions\": [\"paste/runtime forwarding avoids duplicate terminal payloads\"]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-midline-preedit-tail.test.ts\",\n          \"assertions\": [\n            \"a mid-line preedit reproduces committed cells hidden by its opaque overlay and refreshes that tail after terminal renders\",\n            \"arbitrary fully dimmed output remains visible even at column zero\",\n            \"the final-column caret stays visible and the textarea candidate anchor shifts left with an over-wide preedit\",\n            \"cancel, empty resumed updates, and disposal remove transient overlay state\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n          \"assertions\": [\n            \"recorded Windows Korean compositionupdate-without-compositionstart traces reactivate a visible preedit transaction\",\n            \"the resumed transaction commits exactly once and cleans up normally\",\n            \"the ordinary Linux compositionstart sequence remains unchanged\"\n          ]\n        }\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n          \"assertions\": [\n            \"owned releases use live Shift and Option state and current alternate-key flags\",\n            \"owned releases retain the delivered press identity across layout, Shift, and NumLock changes\",\n            \"a native dead-key keyup is consumed without inventing an unmatched protocol release\",\n            \"event-type pop consumes without bytes and repeat keydowns cannot replace the original release owner\"\n          ]\n        }",
        "Renderer direct-owner cleanup retires the complete layout-base-character suite (one registration). Lost alarm: layout invalidation blocks focus refresh, fences an older snapshot, and accepts the new-generation character. The removed case consumed private snapshot/reset state and internal refresh-count accounting. No equivalent replacement or new execution is claimed. Remaining IME/keyboard/provider sources and the unchanged fcitx4 receipt retain their existing bounded qualifications; this removal does not validate their selectors. Historical removed active mappings (verbatim semantic values; no longer active): [{\"field\":\"testFiles\",\"previous\":[\"src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts\"]},{\"field\":\"commands\",\"previous\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts\"]}]",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. The complete mocked AgentTerminalPreview component suite is removed, including the snapshot-proven kitty mirror forwarding alarm. Remove its active file, command token and assertion reference; the other IME drivers are unchanged and do not replace the removed component checks. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3460 historical original active selectors (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts src/shared/terminal/input/terminal-composer-draft.test.ts src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts\",\n        \"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n        \"pnpm run test:e2e -- tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n        \"pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts\"\n      ]\ntestFiles: [\n        \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-native-text-forwarder.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-macos-keybinding-dict-trace.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-composer-placeholder-mask.test.ts\",\n        \"src/shared/terminal/input/terminal-composer-draft.test.ts\",\n        \"src/main/daemon/emulation/testing/terminal-cursor-line-context.test.ts\",\n        \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n        \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n        \"src/preload/app-restart-checkpoint-routing.test.ts\",\n        \"src/renderer/src/web/web-preload-api-ui.test.ts\",\n        \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n        \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n        \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n        \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n        \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n        \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-linux-fcitx4-trace-replay.test.ts\",\n          \"assertions\": [\n            \"real fcitx4 Sogou captures (GTK module and XIM) send only the committed candidate for Space and digit picks, under legacy keys and kitty flags 1 and 5\",\n            \"a real fcitx4 Google Pinyin in-client preedit still commits through the composition path\",\n            \"an XIM pick's code-less keydown pairs with its keyup so kitty event reporting sends one release per pick\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/ime/terminal-ime-xterm-resumed-preedit-visibility.test.ts\",\n          \"assertions\": [\"A transaction inferred from update alone commits and cleans up.\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-option-composed-ascii.spec.ts\",\n          \"assertions\": [\n            \"a live kitty-negotiated pane receives the Option-composed ASCII character, not the physical alt chord\",\n            \"an Option layer that also needs Shift still reaches the pty as text\",\n            \"configured Option-as-Alt still reports the layout-resolved physical chord\",\n            \"a non-ASCII Option glyph still reaches the application as its alt hotkey\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/input/keyboard/terminal-option-kitty-release.test.ts\",\n          \"assertions\": [\n            \"Autorepeat cannot replace the first release sender; a fresh press can replace an orphaned sender for the same key.\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts\",\n          \"assertions\": [\n            \"rapid input-source changes coalesce to one latest-generation refresh signal\"\n          ]\n        },\n        {\n          \"file\": \"src/preload/app-restart-checkpoint-routing.test.ts\",\n          \"assertions\": [\n            \"macOS keyboard reads and the change subscription remain wired after main integration\",\n            \"the two-phase change payload reaches the renderer unchanged\",\n            \"the subscription disposer removes the exact IPC listener\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts\",\n          \"assertions\": [\n            \"the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output\",\n            \"flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release\",\n            \"both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes\",\n            \"the release is emitted by the forwarder while xterm's internal kitty flags stay 0\",\n            \"the mutable flags getter is read exactly once, at commit time, never on keydown or keyup\",\n            \"auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx\",\n          \"assertions\": [\n            \"the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/terminal/protocol/input-modes/terminal-kitty-keyboard-mode-tracker.test.ts\",\n          \"assertions\": [\n            \"a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback\",\n            \"restoreSnapshotFlags proves only the active screen\",\n            \"provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/terminal-preview-output-stream.test.ts\",\n          \"assertions\": [\n            \"a partially covered sequenced chunk retains exactly its unseen suffix in live mode\",\n            \"a transformed overlap remains unsliced in replay mode\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/chinese-ime-chat-input-repro.spec.ts\",\n          \"assertions\": [\n            \"Sogou-style Space candidate selection submits only the committed Chinese character\",\n            \"Sogou-style digit candidate selection submits only the committed Chinese phrase\",\n            \"Post-composition Sogou-style digit selection stays out of the PTY after compositionend\",\n            \"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-korean-endofrow-preedit-cell-span.spec.ts\",\n          \"assertions\": [\n            \"the rendered final-column preedit caret remains inside the terminal screen\",\n            \"a rendered full-width Korean preedit spans materially more than the one terminal cell reported in #12729\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-korean-midline-preedit-occlusion.spec.ts\",\n          \"assertions\": [\n            \"the rendered opaque overlay reproduces every committed row-tail cell its measured rectangle hides\",\n            \"a real Codex placeholder with bold prompt, blank footer gap, model footer, and cursor at column 2 stays masked\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
    },
    {
      "id": "terminal-input.windows-conpty-keyboard-reset",
      "title": "Windows ConPTY resets keyboard protocol state after agents and TUIs exit",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-platform",
      "layer": "windows-electron-conpty",
      "surfaces": [
        "Windows ConPTY",
        "keyboard protocol",
        "agent exit",
        "TUI exit",
        "standard key input"
      ],
      "platforms": ["windows"],
      "providers": ["local", "daemon", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6999",
        "https://github.com/stablyai/orca/pull/6858"
      ],
      "invariant": "After an agent or TUI exits on Windows ConPTY, ordinary Enter, Backspace, Arrow, paste, and printable keys must be delivered as standard shell input, not stale Kitty/CSI-u or application-mode bytes.",
      "oracle": "A Windows gate records PTY input bytes before and after agent/TUI exit, submits real shell commands, and proves standard keys work without protocol leakage.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Windows provider-contract or focused Electron gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Gate is registered as a known Windows ConPTY gap; no command is wired."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break proof for stale keyboard-protocol mode after agent/TUI exit."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Must not add per-key global session listing or repeated protocol reset work on the typing hot path."
      },
      "promotionCriteria": [
        "Use byte-level PTY input evidence, not only screenshots.",
        "Start as Windows soak until skip and flake behavior is known.",
        "Fail promotion on silent Windows environment skips."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "Real Windows ConPTY execution is not covered by macOS/Linux CI."
      ],
      "demotionRule": "Cannot promote if standard-key behavior is inferred without PTY byte evidence."
    },
    {
      "id": "terminal-input.windows-modified-enter-routing",
      "title": "Windows modified Enter routes agent-compatible bytes to the active pane",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-input",
      "layer": "main-provider-renderer-unit-and-windows-electron",
      "surfaces": [
        "terminal input",
        "Windows modified Enter",
        "agent identity",
        "split panes",
        "SSH",
        "WSL",
        "remote runtime"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1342 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Deterministic main/renderer tests run on macOS and exercise simulated Windows plus POSIX/Linux process-confirmation behavior. They cover exact local-ConPTY membership, detached-child rejection, SSH and paired-runtime host-platform routing including legacy runtime PTY IDs, active-PTY ownership after worktree host changes, Windows-to-WSL routing, unknown-metadata fallback, production handler composition, KKP authorization on every host, process-confirmed Droid routing and launch-triggered confirmation, typed-alias and forged-OSC isolation, shells without OSC 133, split/detach ownership with preserved shell classification, stale PTY exit/rebind rejection, command-generation revocation, daemon v21 warm-reattach identity, unavailable inspection, and lazy subprocess/RPC callback counts. A live linux-arm64 Docker target additionally proved real relay deployment, SSH PTY host detection, and exact inactive/active KKP bytes. The Electron byte test runs only on Windows; live Windows evidence remains uncollected. Test failures report exact expected bytes; no product telemetry or raw terminal logging is added. Protocol-version constant inventories are excluded from handshake and foreground-confirmation evidence. The test-value audit narrows store-active-worktree-terminal-creation.test.ts to selected same-ID local/SSH folder creation and owner-context propagation plus split-survivor relay-drop/orphan protection. Immediate detach PTY/relay/tab-map synchronization, plain root-group inventory, quick-command/startup-cwd field normalization, and Windows default/project-runtime/UNC/SSH/Git-Bash shell-metadata examples are intentionally removed. Those direct state and metadata alarms are lost; remaining cases are not equivalent replacements. Historical executed commands, counts and results remain unchanged; no new shell-spawn, input-byte, live platform, remote or mobile evidence is claimed. The test-value audit removes the direct Windows installed-path case for Droid npm cmd basename recognition. That exact unit alarm is lost; retained command-line recognition cases are not equivalent replacements. The direct Droid recognition assertion remains a deferred obligation. Historical evidence and broader process-confirmation/input-routing obligations remain unchanged; no new executed coverage, owner-gap closure or credit is claimed. Audit1318: src/shared/agent-status/process/agent-process-recognition.test.ts: Large copied interpreter/npm/provider argv inventory, captured Windows literals and production-generated OMP roundtrips classify strings without running processes or reading an OS table. Intentionally lose entrypoint/lookalike/headless/provider recognition alarms; no physical process boundary or equivalent replacement. src/shared/process-table-snapshot.test.ts: Retain direct cache state-machine regressions: evidence age is measured from capture start and a fresh request queued behind an existing capture waits for its own post-request scan. Remove cache/count/parser/index and fake-OS buffer/timeout inventories, deliberately losing truncation, strict/lenient, ceiling, busy-host and timeout alarms. Injected runPs promises are not physical OS ps execution. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/7620",
        "https://github.com/stablyai/orca/pull/7668"
      ],
      "invariant": "Shift+Enter key recognition follows the client OS, while emitted bytes follow the active application and PTY host: active Kitty keyboard protocol authorizes CSI-u on every host; otherwise Windows hosts use Esc+CR except when allowlisted Droid ownership or fresh routing-trusted Droid process evidence authorizes CSI-u, and non-Windows hosts use Esc+CR. The active SSH connection, remote-runtime PTY owner, or live local session outranks later worktree ownership changes, and missing host-platform metadata falls back to the client. Every new command and PTY replacement revokes stale agent routing until current evidence settles; split or reused panes cannot inherit sibling or prior-PTY authority; unrelated keys perform no host, agent, protocol, or ConPTY lookup.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1342 retired changed-source receipts. Historical oracle account: Renderer tests assert exact bytes across client/PTY-host combinations, including Kitty keyboard protocol active and inactive on Windows and non-Windows hosts, and prove SSH identity, the environment encoded in an active remote-runtime PTY id, and live local-session identity outrank current worktree ownership, while unavailable platform metadata falls back to the client. A live linux-arm64 SSH PTY independently captured Esc+CR with KKP inactive and CSI-u with KKP active. Fresh Windows process evidence authorizes Droid bytes only after a recognized global candidate is intersected with the exact ConPTY console process list; detached descendants, helper failure/timeout/root-only fallback, stale PTY exit/rebind results, typed text, and hook/OSC output fail closed. A new OSC 133;C immediately publishes a routing-neutral generation, including during D-to-C races. In cmd.exe/Git Bash/custom shells without OSC 133, accepted inferred commands start the same fresh generation; accepted submit/interrupt, title exit, focus, and visibility revoke trusted Droid bytes while one bounded confirmation runs. Detach preserves the live PTY's source shell override so WSL/native classification cannot change with the current default. Ordinary fast shell commands use cached/no-scan paths; routing-relevant confirmation bypasses cached process snapshots and keeps the bounded three-read ladder. Daemon protocol v21 persists only an allowlisted launchAgent; warm reattach uses it as a display/confirmation hint and restores routing only after current process proof. The Windows Electron test focuses the real xterm textarea and records exact renderer-to-main PTY writes.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1342 retired changed-source receipts; reduced selector has no new soak result. Historical account: The deterministic units are stable locally; the Windows-only Electron byte path needs CI or nightly soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation. Historical account: Reverting to the previous unconditional Windows Esc+CR branch fails the Droid byte assertion, while resolving launch metadata from any key other than the active pane fails the split-survivor isolation assertion. Saved intentional-break artifacts and live Windows history are still missing."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1342 changed test sources; no new measurement. Previous account: Callback-count tests prove unrelated ordinary keys invoke neither host, agent, nor Kitty-protocol resolution. Host and agent callbacks are created once per keyboard effect, so printable input adds no per-key allocations or store reads. Shift+Enter performs bounded synchronous active-transport and indexed store lookups, plus at most one pane-keyed protocol-mode lookup when trusted Windows Droid evidence does not already authorize CSI-u, with no IPC, RPC, subprocess, polling, listener, or timer. Typed text performs no routing write. Ordinary fast OSC 133;C-to-D shell commands perform no fresh confirmation RPC or process scan. An accepted submit/interrupt while trusted Droid is current, a typed allowlisted agent command, title exit, focus, visibility transition, or an idle burst after trusted Droid Shift+Enter can schedule the bounded confirmation ladder; each event cancels/deduplicates prior work and no timer recurs after settling. Windows confirmation performs one fresh process-table scan and forks exact ConPTY membership only after a recognized agent candidate appears; no recognized candidate makes zero helper calls. Same-turn fresh requests share one scan and later arrivals queue at most one successor. Recovery remains three bounded one-shot reads (350 ms, 1.2 s, 6 s). No polling loop, provider fanout, persistent listener, hidden-pane wake loop, or per-printable-key work is added."
      },
      "promotionCriteria": [
        "Run the exact PTY-byte Electron oracle on Windows without silent platform skips.",
        "Collect stable runtime and flake history for local and daemon Windows ConPTY while retaining deterministic host-routing assertions for SSH, WSL, and remote runtime.",
        "Attach saved intentional-break evidence for Droid capability removal and split-sibling identity leakage."
      ],
      "knownGaps": [
        "No Windows runner or live Windows PTY evidence is attached; the Electron byte test skips on macOS and Linux, while a live Linux SSH PTY covers only the remote Linux host path.",
        "Droid agent-specific CSI-u authorization is available only from trusted pane evidence; without it, Windows and non-Windows PTY hosts depend on the application's Kitty keyboard protocol state.",
        "The Electron test injects allowlisted pane identity rather than launching the real Droid and Antigravity binaries.",
        "If both Windows process-enumeration backends remain unavailable through the bounded ladder, routing fails closed to the legacy Esc+CR path; no live Droid artifact covers that degraded host configuration.",
        "Protocol v21 restarts older daemons because the minimal persisted launchAgent is a new contract; sessions preserved by pre-v21 daemons cannot supply warm-reattach launch ownership and fail closed until current process confirmation or restart.",
        "No live daemon, WSL, remote-runtime, paired-web, or restore/replay byte artifact has been collected; SSH is covered only by a macOS-client-to-Linux-host relay run.",
        "A running PTY keeps its spawn-time ORCA_PANE_KEY after pane-to-tab detach. This change transfers launch/process routing evidence and retires the stale hook snapshot, but does not redesign future hook reattribution across tab IDs.",
        "The test-value audit narrows store-active-worktree-terminal-creation.test.ts to selected same-ID local/SSH folder creation and owner-context propagation plus split-survivor relay-drop/orphan protection. Immediate detach PTY/relay/tab-map synchronization, plain root-group inventory, quick-command/startup-cwd field normalization, and Windows default/project-runtime/UNC/SSH/Git-Bash shell-metadata examples are intentionally removed. Those direct state and metadata alarms are lost; remaining cases are not equivalent replacements. Historical executed commands, counts and results remain unchanged; no new shell-spawn, input-byte, live platform, remote or mobile evidence is claimed.",
        "Audit1318: src/shared/agent-status/process/agent-process-recognition.test.ts: Large copied interpreter/npm/provider argv inventory, captured Windows literals and production-generated OMP roundtrips classify strings without running processes or reading an OS table. Intentionally lose entrypoint/lookalike/headless/provider recognition alarms; no physical process boundary or equivalent replacement. src/shared/process-table-snapshot.test.ts: Retain direct cache state-machine regressions: evidence age is measured from capture start and a fresh request queued behind an existing capture waits for its own post-request scan. Remove cache/count/parser/index and fake-OS buffer/timeout inventories, deliberately losing truncation, strict/lenient, ceiling, busy-host and timeout alarms. Injected runPs promises are not physical OS ps execution. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-25\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.88,\n          \"summary\": \"Twenty-six focused test files passed (489 tests) on the PR head, covering fresh-scan ordering/deduplication, exact ConPTY membership and detached-child rejection, stale PTY guards, daemon v21 launch ownership with current-process confirmation, no-OSC command/exit recovery, preserved detach shell classification, unavailable evidence, routing-neutral command generations, exact shortcut bytes, and the composed daemon-plus-tracker contract; the Windows Electron byte test remains platform-gated and is not counted as local macOS evidence.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-status/process/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts\"\n        }",
        "Retired during audit1319 current-main refresh; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\"durationSeconds\":27.07,\"summary\":\"Test Files  22 passed (22); Tests  544 passed | 1 skipped (545). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"}",
        "Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\n          \"durationSeconds\": 24.59,\n          \"summary\": \"Test Files  22 passed (22); Tests  544 passed | 1 skipped (545). Focused current Linux unit run; Windows-specific execution remains platform-gated. Single execution, no p95, physical-provider or cross-platform measurement. Source head f6290fb9d8c471dfb79a838d86eb6398582744f4.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/shared/process-table-snapshot.test.ts\",\n    \"assertions\": [\n      \"same-turn fresh requests queued behind an existing capture share a post-request scan\"\n    ]\n  },\n  {\n    \"file\": \"src/main/providers/agent-foreground-process.test.ts\",\n    \"assertions\": [\n      \"successful root-present Windows enumeration and failed, blank, malformed, or root-missing enumeration remain distinct evidence states\",\n      \"an observed shell root with no children is authoritative while a snapshot omitting that root is unavailable\",\n      \"an attached Droid candidate is authorized only when exact ConPTY membership contains it, while a detached Start-Process descendant is rejected\",\n      \"a Windows process-table scan with no recognized agent performs zero ConPTY membership helper forks\",\n      \"fresh POSIX scan failure or a snapshot missing the PTY root is unavailable rather than shell proof\",\n      \"the compatibility process-name API still preserves its existing fallback contract for other consumers\"\n    ]\n  },\n  {\n    \"file\": \"src/main/providers/windows-console-attached-processes.test.ts\",\n    \"assertions\": [\n      \"the fixed node-pty helper returns validated integer console membership containing the PTY root\",\n      \"root-only fallback, malformed/missing-root messages, spawn errors, and a silent helper timeout all fail closed\",\n      \"the bounded timeout kills the child helper exactly once\"\n    ]\n  },\n  {\n    \"file\": \"src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts\",\n    \"assertions\": [\n      \"stops holding a dead agent once the job answer is only a superset\",\n      \"restores the idle refresh backoff once the dead identity is gone\",\n      \"never expires an identity while scans stay degraded\",\n      \"never expires an identity while the job answer is unverifiable\"\n    ]\n  },\n  {\n    \"file\": \"src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts\",\n    \"assertions\": [\n      \"a delayed foreground confirmation is discarded after the owning PTY exits\"\n    ]\n  },\n  {\n    \"file\": \"src/main/daemon/daemon-pty-adapter.test.ts\",\n    \"assertions\": [\n      \"new daemon sessions and warm reattach results carry the same minimal allowlisted launchAgent\"\n    ]\n  },\n  {\n    \"file\": \"src/main/daemon/daemon-server.test.ts\",\n    \"assertions\": [\n      \"daemon protocol v21 persists allowlisted launchAgent across reattach and drops unknown identity strings\"\n    ]\n  },\n  {\n    \"file\": \"src/main/daemon/pty-subprocess.test.ts\",\n    \"assertions\": [\n      \"Windows daemon foreground lookup can return PowerShell synchronously before async process-tree enrichment resolves the agent\",\n      \"the enriched agent result is served by a later foreground read\",\n      \"fresh confirmation awaits a post-request scan instead of serving cached PowerShell and returns null when inspection is unavailable\"\n    ]\n  },\n  {\n    \"file\": \"tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\n    \"assertions\": [\n      \"the real daemon handle and pane tracker keep restored Droid identity when confirmation resolves after the old cache window\",\n      \"one fresh command-finish scan confirms real shell exit, while unavailable inspection performs exactly three bounded reads and never claims shell\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts\",\n    \"assertions\": [\n      \"the production keyboard-policy boundary requires active-host routing and composes macOS Shift+Enter with Windows PTY bytes\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts\",\n    \"assertions\": [\n      \"a legacy remote PTY id retains the transport's captured runtime environment identity\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts\",\n    \"assertions\": [\n      \"SSH terminals use remote-platform metadata and execution-host identity when the active transport has not captured a connection id\",\n      \"encoded and legacy active remote-runtime PTY identities plus a live local PTY session outrank later worktree host changes\",\n      \"a live WSL session normalizes to a Linux terminal host\",\n      \"missing SSH/runtime platform metadata and local terminals fall back to the client platform\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts\",\n    \"assertions\": [\n      \"Windows defaults and non-Droid agents preserve Esc+CR while explicit Droid capability selects CSI-u\",\n      \"Windows and non-Windows PTYs reached cross-OS use CSI-u only with active Kitty keyboard protocol unless trusted Windows Droid evidence independently authorizes it\",\n      \"unrelated keys invoke neither host, agent, nor protocol callbacks\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts\",\n    \"assertions\": [\n      \"only routing-trusted current process identity overrides launch evidence and confirmed shell foreground clears stale identity\",\n      \"a newer untrusted or neutral command generation blocks stale launch ownership until confirmation\",\n      \"only allowlisted fresh process or pane-scoped launch ownership selects Droid's CSI-u capability\",\n      \"forged hook or OSC-derived Droid status cannot change the Windows byte encoding\",\n      \"after split and original-pane close, a sole surviving sibling cannot inherit the original pane's Droid launch identity\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts\",\n    \"assertions\": [\n      \"manual and restored local agent identity is published from bounded foreground-process reads\",\n      \"a delayed read cannot publish after the pane rebinds to a replacement PTY id\",\n      \"every new command publishes a routing-neutral generation before confirmation\",\n      \"typed agent text only widens the confirmation window and never becomes published or routable identity\",\n      \"unavailable typed-command confirmation stays on legacy routing through the three-read ladder and then fails closed\",\n      \"ordinary fast OSC 133;C-to-D command pairs publish shell without a fresh confirmation scan\",\n      \"command-start and visible launch recovery use at most three reads across the bounded 350 ms, 1.2 s, and 6 s ladder\",\n      \"null and rejected reads participate in the same bounded known-identity ladder\",\n      \"command-finished accepts one fresh recognized shell scan when agent evidence exists, while unavailable final evidence retires routing without claiming shell\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\n    \"assertions\": [\n      \"typing droid does not route CSI-u until fresh process evidence confirms Droid\",\n      \"null and rejected command-start reads never promote typed Droid text to process evidence\",\n      \"a manually typed Droid in a shell without OSC 133 gains routing only after accepted-input fresh confirmation\",\n      \"accepted no-OSC exit or interrupt input immediately revokes trusted Droid bytes and confirms the returned shell\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\n    \"assertions\": [\n      \"after detach remount, pane-key launch/process identity forces a leaked nested OSC 133;D through foreground confirmation\",\n      \"an identityless visible-read versus OSC 133;D race cancels stale sampling and fails closed to shell\",\n      \"daemon-returned allowlisted launchAgent requests warm-reattach confirmation without restoring stale byte authority or the original args/env payload, while missing identity fails closed\",\n      \"an unknown persisted wrapper cannot spoof launch identity and confirmed shell state prevents repeat focus scans\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts\",\n    \"assertions\": [\n      \"allowlisted daemon launchAgent reaches PtyConnectResult on reattach\",\n      \"unknown launch identity is dropped at the renderer transport boundary\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts\",\n    \"assertions\": [\n      \"pane-to-tab detach moves only the detached leaf's launch and process identity to its new pane key\",\n      \"pane-to-tab detach preserves the source PTY shell override across native PowerShell and WSL classifications\",\n      \"the source hook snapshot is retired rather than copied to a key the running PTY cannot emit\",\n      \"the detached Droid keeps CSI-u while the source sibling keeps its own legacy encoding\"\n    ]\n  },\n  {\n    \"file\": \"tests/e2e/terminal-shortcuts.spec.ts\",\n    \"assertions\": [\n      \"on Windows the focused terminal sends CSI-u bytes for a Droid pane and Esc+CR bytes after switching that same pane to Antigravity identity\",\n      \"the byte oracle observes the real renderer-to-main PTY write path rather than terminal DOM state\"\n    ]\n  }\n]",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts\",\n    \"assertions\": [\n      \"a still-running Droid process republishes Droid instead of being overwritten with shell-foreground evidence\",\n      \"typed Droid input cannot replace live Antigravity process or pane-scoped launch identity inside another TUI\",\n      \"typed Droid input on SSH or remote-runtime panes never writes local process evidence\",\n      \"Droid routing survives a fresh command-finish scan that still sees Droid and retires after one fresh shell result\",\n      \"a D-to-C transition immediately routes legacy bytes while the new command generation is pending\",\n      \"unavailable command-finish evidence resolves deferred cleanup, returns legacy routing, and does not assert shell foreground\"\n    ]\n  }\n]",
        "Retired selector metadata during audit1345; historical selector record preserved unchanged: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\"pnpm run test:e2e -- tests/e2e/terminal-shortcuts.spec.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts\"],\"testFiles\":[\"src/main/daemon/daemon-pty-adapter.test.ts\",\"src/main/daemon/daemon-pty-router.test.ts\",\"src/main/daemon/daemon-server.test.ts\",\"src/main/daemon/degraded-daemon-pty-provider.test.ts\",\"src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts\",\"src/main/daemon/pty-subprocess.test.ts\",\"src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts\",\"src/main/providers/agent-foreground-process.test.ts\",\"src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts\",\"src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts\",\"src/main/providers/windows-console-attached-processes.test.ts\",\"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts\",\"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts\",\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts\",\"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts\",\"src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts\",\"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts\",\"src/shared/process-table-snapshot.test.ts\",\"tests/e2e/terminal-foreground-confirmation.unit.test.ts\",\"tests/e2e/terminal-shortcuts.spec.ts\"],\"assertionRefs\":[]}"
      ],
      "demotionRule": "Keep non-blocking or demote to protection none if the Windows byte test silently skips, flakes without an actionable artifact, routes bytes using tab/title/terminal-output heuristics, or adds any ordinary-key lookup, IPC, polling, scan, or lifecycle leak."
    },
    {
      "id": "terminal-input.guarded-agent-send-authorization",
      "title": "Guarded agent sends authorize only the confirmed exact PTY",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-input",
      "layer": "runtime-provider-contract",
      "surfaces": [
        "terminal input",
        "guarded note sends",
        "agent status",
        "PTY identity",
        "foreground process confirmation"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1959 (sources 1957:5): Remove supplied-title/recognized-foreground/braille scalar happy authorization examples and quarter-circle glyph classification. Retain guarded-send refusals for missing/spinner-only evidence, actual runtime managed-launch token authority, unverified hint refusal and replacement-incarnation invalidation under injected process ports. The complete dated 20.9s nine-test receipt is archived rather than reduced. It was the sole current passed receipt, so demote this gate to protection none and archive its complete prospective selectors, all assertion objects and covered scope; retained source callbacks are no active execution credit. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1911: The complete Windows console-membership suite is removed: its sole remaining synthetic kill-error-after-timeout settlement/listener-count alarm is intentionally lost. The historical assertion mapping named broader fixed-helper membership/failure policies; removing this obsolete mapping does not claim that the single removed case had proved those policies or that remaining tests replace it. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists. Protocol-version constant inventories are excluded from handshake and foreground-confirmation evidence. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/8303"],
      "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; a generic busy title requires independent agent identity from the title, a verified managed launch bound to the current PTY incarnation, or the foreground process; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
      "oracle": "Audit1959 (sources 1957:5): Remove supplied-title/recognized-foreground/braille scalar happy authorization examples and quarter-circle glyph classification. Retain guarded-send refusals for missing/spinner-only evidence, actual runtime managed-launch token authority, unverified hint refusal and replacement-incarnation invalidation under injected process ports. The complete dated 20.9s nine-test receipt is archived rather than reduced. It was the sole current passed receipt, so demote this gate to protection none and archive its complete prospective selectors, all assertion objects and covered scope; retained source callbacks are no active execution credit. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1911: The complete Windows console-membership suite is removed: its sole remaining synthetic kill-error-after-timeout settlement/listener-count alarm is intentionally lost. The historical assertion mapping named broader fixed-helper membership/failure policies; removing this obsolete mapping does not claim that the single removed case had proved those policies or that remaining tests replace it. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "focused runtime, RPC, PTY provider, and renderer routing units"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Deterministic units have local coverage only; promotion requires repeated CI and platform history."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Audit1959: Historical intentional-break account only; this packet executes no reduced selector and the gate has no current execution evidence. Historical prior account (preserved verbatim): Before the verified-launch fallback, the managed-Claude unavailable-foreground case failed with isRunningAgent false; the focused file passed 7 tests after the fix. Removing the launch-incarnation comparison makes the replacement-incarnation refusal fail. Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; physical Windows evidence remains missing."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit1959: Historical count/performance account only; no current gate protection or measured budget result after its sole dated receipt is retired. Historical prior account (preserved verbatim): Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove verified managed-Claude launch identity, permission/title blockers, and ordinary recognized-agent evidence add zero provider calls; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
      },
      "promotionCriteria": [
        "Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
        "Collect stable CI and flake history across local and daemon providers on Windows plus representative macOS/Linux coverage.",
        "Attach saved intentional-break evidence for confirmation removal and exact-PTY revalidation removal."
      ],
      "knownGaps": [
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Physical Windows validation is unavailable on the current macOS host; exact ConPTY membership is covered deterministically.",
        "Electron annotation golden-path, repeat-send, adjacent-menu evidence, and screenshots are left to coordinator validation.",
        "SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
        "No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-25\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts\",\"result\":\"passed\",\"durationSeconds\":13.74,\"summary\":\"Twelve focused test files passed (1351 tests, 1 skipped), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result\",\"shell, non-agent, null, thrown, and missing confirmation remain fail-closed\",\"title blockers and ordinary recognized agent evidence add no confirmation call\",\"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY\",\"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver\"]}]",
        "Audit1911: The complete Windows console-membership suite is removed: its sole remaining synthetic kill-error-after-timeout settlement/listener-count alarm is intentionally lost. The historical assertion mapping named broader fixed-helper membership/failure policies; removing this obsolete mapping does not claim that the single removed case had proved those policies or that remaining tests replace it. Only the deleted explicit source tokens, testFile and whole assertionRef are removed. Meaningful remaining source selectors/assertions and unaffected dated receipts retain their original scope. No equivalent replacement, fresh reduced-gate, native/platform/provider, soak or measured-budget result is claimed. Exact retired authored alarms: 'absorbs an asynchronous kill error after timeout settlement'.",
        "Audit1911 historical original retired assertion object, preserved verbatim; this is not an active assertion mapping:\n{\n          \"file\": \"src/main/providers/windows-console-attached-processes.test.ts\",\n          \"assertions\": [\n            \"exact ConPTY console membership comes from the fixed node-pty helper\",\n            \"malformed, incomplete, timed-out, and spawn-error membership reads fail closed\"\n          ]\n        }",
        "Audit1959 (sources 1957:5): Remove supplied-title/recognized-foreground/braille scalar happy authorization examples and quarter-circle glyph classification. Retain guarded-send refusals for missing/spinner-only evidence, actual runtime managed-launch token authority, unverified hint refusal and replacement-incarnation invalidation under injected process ports. The complete dated 20.9s nine-test receipt is archived rather than reduced. It was the sole current passed receipt, so demote this gate to protection none and archive its complete prospective selectors, all assertion objects and covered scope; retained source callbacks are no active execution credit. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet.",
        "Audit1959 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 20.9,\n          \"summary\": \"The focused file passed 9 tests, including current-incarnation managed-Claude authorization with zero foreground calls and fail-closed bare, unverified, and replacement-incarnation quarter-circle titles.\"\n        }",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/quarter-circle-title-send-authorization.test.ts\",\n          \"assertions\": [\n            \"a verified managed-Claude launch authorizes a task-text quarter-circle title without foreground-process work\",\n            \"a bare pane, an unverified launch hint, and a replacement PTY incarnation remain refused\",\n            \"quarter circles remain working signals and braille authorization is unchanged\"\n          ]\n        }",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/terminal-send.test.ts\",\n          \"assertions\": [\n            \"a handle rebind during guarded status evaluation returns not writable and writes zero bytes\",\n            \"the callback's actual PTY must equal the handle binding before status can authorize a write\"\n          ]\n        }",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts\",\n          \"assertions\": [\"selected active-agent note sends retain guarded paste and submit routing\"]\n        }",
        "Audit1959 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess-foreground-degraded-scan.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts\"\n      ]",
        "Audit1959 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\n        \"src/main/runtime/quarter-circle-title-send-authorization.test.ts\",\n        \"src/main/runtime/orca-runtime.test.ts\",\n        \"src/main/runtime/rpc/terminal-send.test.ts\",\n        \"src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts\",\n        \"src/main/providers/agent-foreground-process.test.ts\",\n        \"src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts\",\n        \"src/main/daemon/pty-subprocess/testing/pty-subprocess-foreground-degraded-scan.test.ts\",\n        \"src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts\",\n        \"src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts\"\n      ]",
        "Audit1959 historical original coveredPlatforms object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"macos\"]",
        "Audit1959 historical original coveredProviders object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n[\"local\", \"daemon\"]"
      ],
      "demotionRule": "Keep non-blocking or demote to protection none if a generic busy title authorizes without exact title, verified-launch, or foreground identity; provider confirmation becomes unconditional; exact-PTY mismatch can write bytes; unsupported providers fail open; or the focused gate flakes without an actionable product or harness defect."
    },
    {
      "id": "terminal-input.cli-agent-prompt-submit",
      "title": "CLI text plus Enter settles recognized agent composers before submit",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-input",
      "layer": "cli-rpc-runtime-pty-contract",
      "surfaces": [
        "terminal send CLI",
        "terminal.send RPC",
        "agent prompt injection",
        "PTY writes",
        "bracketed paste"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retired affected callbacks and complete execution receipts. No equivalent fresh execution, provider/platform scope, soak or measured-budget credit is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4328",
        "https://github.com/stablyai/orca/issues/14525"
      ],
      "invariant": "A public CLI send containing non-empty text plus Enter and no interrupt identifies agent-prompt intent. The owning runtime uses bracketed-paste and settled submit only when a fresh foreground-process read positively identifies the exact target as Claude or Codex on a desktop call; every other agent, stale agent metadata over a shell, text-only input, bare Enter, interrupts, mobile input, query replies, and older clients keep the direct terminal contract.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. No current executed oracle remains after the authorized source-case and receipt retirements.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "promotionCriteria": [
        "Collect live Codex and Claude CLI sends on representative slow systems.",
        "Retain mixed-version evidence that old hosts strip the optional intent and new hosts accept old clients without a protocol bump."
      ],
      "knownGaps": [
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1586 removes mock-only terminal prompt forwarding and capability assertions without equivalent replacement coverage. Retained CLI tests cover unverified close failures and a missing prompt receipt after preflight using injected host responses; they do not establish actual PTY delivery, host restart or durable replay. Assertion references selecting removed alarms are retired; unaffected execution receipts remain unchanged.",
        "Live SSH/daemon/remote-runtime evidence is not yet attached.",
        "Only Claude and Codex opt into settlement; every other agent retains the legacy behavior until independently validated.",
        "A new CLI talking to an old host safely loses the optional field and therefore keeps the old timing behavior until the host updates.",
        "The E2E fake agent models the submission race without requiring external agent authentication; live account-backed agents are covered separately.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-15\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-prompt-injection.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts\",\"result\":\"passed\",\"durationSeconds\":23.2,\"summary\":\"After rebasing onto current main, the final narrowed runtime/CLI/RPC suite passed 1,201 tests with one skip, including fresh Claude/Codex identity, stale-agent shell fallback, and legacy timing for every other configured agent.\"}",
        "Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1383 historical assertion inventory for changed sources:\n[\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-agent-prompt-send.test.ts\",\n    \"assertions\": [\n      \"a freshly proven Claude or Codex desktop target uses settled prompt delivery\",\n      \"a non-target agent or shell preserves the existing direct send\"\n    ]\n  }\n]",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"Claude and Codex wait for marker-gated composer quiescence before submit\",\"every other configured TUI agent retains the legacy platform delay\",\"a speculative CLI prompt check does not poll wrapper foregrounds\",\"the PTY write boundary retains bracketed framing and one delayed submit\"]}]",
        "Audit1991: Remove partial-runtime terminal-send micro-alarms; the reduced RPC source retains held viewport admission, authenticated-client spoof refusal, text admission and stale-binding fences. Preserve the3 unrelated historical repro and source-built end-to-end receipts at their original exact commands; do not transfer their counts or physical platform claims to reduced unit callbacks. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites."
      ],
      "demotionRule": "Keep experimental or demote to protection none if direct shell/mobile/query input is reframed, an unrecognized target receives bracketed paste, a prompt can emit duplicate Enter, mixed-version decoding rejects the optional field, or the deterministic fake-composer candidate requires a rescue send."
    },
    {
      "id": "terminal-input.agent-prompt-injection",
      "title": "Orchestration agent prompts arrive as bracketed paste before submit",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-input",
      "layer": "runtime-contract-and-cli-repro",
      "surfaces": [
        "terminal input",
        "agent prompt injection",
        "orchestration dispatch",
        "PTY writes",
        "bracketed paste"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-3800",
        "https://linear.app/stably/issue/STA-3904",
        "https://linear.app/stably/issue/STA-4328",
        "https://github.com/stablyai/orca/issues/7226",
        "https://github.com/stablyai/orca/issues/13821",
        "https://github.com/stablyai/orca/issues/14347"
      ],
      "invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and submit exactly once only after the agent can accept Enter. Local worker-start with supported observation must preserve an unobserved turn as start_unknown without revoking authority, closing questions, or triggering a rescue Enter; a worker report during observation must settle normally. Claude and Codex must emit a post-paste composer marker and then settle, or reach the bounded fallback first; every other agent retains the platform delay.",
      "oracle": "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator/coordinator.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts --reporter=dot",
        "node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
      ],
      "testFiles": [
        "src/shared/agent-launch/startup/agent-prompt-injection.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts",
        "src/main/runtime/orchestration/coordinator/coordinator.test.ts",
        "tests/tools/repro-orchestration-long-prompt.mjs"
      ],
      "assertionRefs": [
        {
          "file": "src/shared/agent-launch/startup/agent-prompt-injection.test.ts",
          "assertions": [
            "agent prompts are always framed as bracketed paste",
            "Deferred unit obligation: OMP joins submit to the paste frame while Claude, Codex and unidentified agents keep submit separate; the direct predicate table was removed. Runtime-writer coverage is unchanged.",
            "embedded ESC bytes are made inert before framing",
            "chunk reconstruction preserves the paste frame"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts",
          "assertions": ["failed prompt injection rolls back the active dispatch"]
        },
        {
          "file": "src/main/runtime/orchestration/coordinator/coordinator.test.ts",
          "assertions": [
            "coordinator dispatch failures from prompt injection circuit-break through the DB",
            "silent-skip paths do not attempt prompt injection"
          ]
        },
        {
          "file": "tests/tools/repro-orchestration-long-prompt.mjs",
          "assertions": [
            "fake Codex-like worker observes submit after long orchestration dispatch",
            "32KB task marker survives before submit",
            "prompt bytes include a bracketed-paste frame with zero unframed line breaks"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-07",
          "runner": "local",
          "platform": "macos",
          "command": "node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000",
          "result": "passed",
          "durationSeconds": 2.2,
          "summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "promotionCriteria": [
        "Run the live harness in soak with a self-starting dev runtime or provider-contract fixture.",
        "Add daemon, SSH, remote-runtime, Linux, and Windows evidence or mark narrower provider scope.",
        "Capture stable red/green intentional-break evidence in CI before blocking promotion."
      ],
      "knownGaps": [
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.",
        "No Windows ConPTY, Linux PTY, SSH, daemon, or remote-runtime live evidence yet.",
        "Push-on-idle orchestration message banners remain outside this dispatch-prompt gate.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":11.32,\"summary\":\"4 files and 1,303 tests passed with one skipped. Claude and Codex both wait for post-marker quiescence, and a Codex marker arriving at 7.9 seconds receives a fresh window through its final slow frame. Exact-build live Codex workers accepted injected prompts without manual Enter, replied, called worker_done, and settled successfully in the rendered Electron UI.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":13.3,\"summary\":\"4 files and 1,283 tests passed. The hardened multi-frame oracle failed on the first-marker candidate because it submitted at 751 ms during an intermediate Claude frame; the quiescence candidate waited through the final 1,000 ms frame and submitted once at 2,500 ms. Continuous render output remained bounded to one fallback submit at 8 seconds. An isolated Claude Code 2.1.231 Haiku probe saw the first marker at 400 ms, continued output through 1,500 ms, sent one Enter at 3,000 ms after 1.5 seconds quiet, and created the expected marker; no Fable or Opus probe was used.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":16.9,\"summary\":\"4 files and 1,282 tests passed. Unmodified main wrote Enter at 500 ms before the deterministic Claude composer rendered at 750 ms; the candidate waited for the split show-cursor marker and wrote one Enter. A live Claude Code 2.1.231 Haiku trace rendered the pasted marker and show-cursor in one 523-byte frame without submitting a model request.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-07\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":7.4,\"summary\":\"4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"runtime writes bracketed paste before a delayed submit\",\"Claude and Codex ignore unrelated and split pre-marker output, then wait for render quiescence before one submit\",\"every other configured TUI agent retains the platform delay\",\"a late Codex marker receives a fresh settlement window before one submit\",\"a silent Claude composer reaches one bounded fallback submit\",\"a marked Claude composer with continuous render output reaches one bounded fallback submit\",\"large prompt frames are chunked and reconstructed before submit\",\"partial prompt write failure closes the paste frame and does not submit\"]}]",
        "Audit1943 (sources1934/1935/1938): Pruned coordinator suite retains actual dispatch-failure circuit breaking through SQLite and an actual drift-threshold silent-skip. Both existing prompt-injection aliases remain backed within injected send/terminal/probe scope. Other scalar admission, identity attribution, stop flag and prompt-section/fallback projections are intentionally lost; independent runtime writer and worker-start receipts remain limited to their original selectors, without transferred execution or replacement claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'throws if no tasks exist'; 'records the assignee pane key when the runtime can resolve one'; 'records authenticated process authority for automatic dispatch'; 'can be stopped'; 'threads drift into the preamble when behind > 0 and under threshold'; 'proceeds with stripped spec + drift section when allow-stale-base overrides'; 'proceeds without drift section when probeWorktreeDrift returns null'; 'does not call probeWorktreeDrift when coordinator has no worktree selector'; 'proceeds without drift when probeWorktreeDrift throws'.",
        "Audit1973: Remove mocked injected-preamble forwarding and raw terminal.send absence aliases. Retain the real database rollback alias for failed injection and both unrelated dated receipts. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts\",\n          \"assertions\": [\n            \"orchestration.dispatch uses the agent prompt path for injected preambles\",\n            \"raw terminal.send is not called for injected task prompts\",\n            \"failed prompt injection rolls back the active dispatch\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged."
      ],
      "demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
    },
    {
      "id": "orchestration.notification-mailbox-consistency",
      "title": "Orchestration pointers expose the mailbox their terminal check consumes",
      "maturity": "experimental",
      "protection": "none",
      "owner": "orchestration",
      "layer": "runtime-db-rpc-contract",
      "surfaces": [
        "live-idle terminal notification",
        "Run binding and rebinding",
        "active Dispatch ownership",
        "orchestration check and acknowledgment",
        "outstanding Run Deliveries",
        "runtime restart and durable pointer cursors",
        "pointer transport settlement"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retired affected callbacks and complete execution receipts. No equivalent fresh execution, provider/platform scope, soak or measured-budget credit is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4325",
        "https://github.com/stablyai/orca/issues/14522",
        "internal incident evidence: improve-vps-setup, 2026-08-10"
      ],
      "invariant": "Each message has one stable row ID and authoritative recipient; coordinator-addressed current-delivery inserts are atomically owned by run:<id>. Pointer staging may set delivered_at but never consumes mail. Each Run consumer generation has at most one outstanding Delivery with a fixed ID and fixed message IDs; ordinary checks replay it until an explicit matching acknowledgment marks exactly those rows read. Rebinding fences the old generation, notification types/counts correspond to unread rows retrievable under the same authority, and federation replay imports each stable message identity once without re-waking an already-read duplicate.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. No current executed oracle remains after the authorized source-case and receipt retirements.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "promotionCriteria": [
        "Add isolated live restart and SSH or paired-runtime evidence.",
        "Accumulate stable soak runs before considering blocking promotion."
      ],
      "knownGaps": [
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/stale-title-completion-recovery.spec.ts: bounds semantic ingestion and snapshot tab visits at %i tabs. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1734 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded.",
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No headed Electron restart journey was required to prove the runtime/PTY/check boundary.",
        "No daemon, paired remote-runtime, live SSH, WSL, Linux, or Windows journey has been collected.",
        "Daemon and SSH PTY writes are transport-settled but remain owner-unacknowledged; capability-negotiated owner acknowledgments are separate protocol work.",
        "Direct and Dispatch mail stay durable and explicitly checkable but do not synthesize agent turns until a backward-compatible pinned action or passive UI exists.",
        "Passive renderer-native unread UI and opt-in coordinator wake policy remain separate product work.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-10-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-titles.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/runtime/orchestration-mailbox-routing.test.ts\",\"result\":\"passed\",\"durationSeconds\":10.63,\"summary\":\"The three consolidated mailbox roots passed all 64 cases (22 title, 12 delivery, 30 routing) in a focused local run with the production Bun and Node project routing.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-09-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\",\"result\":\"passed\",\"durationSeconds\":4.73,\"summary\":\"267 tests passed after the pointer-write path moved to the three-valued WriteSettlement union. New coverage: a dropped in-flight SSH settlement reaches the stager as unverifiable with bytes handed to the transport, a settled write that throws mid-pointer preserves the write-attempted reservation, an Enter whose settlement is lost stays at enter-attempted with no second Enter after restart, a refusal releases the reservation and drains a delivery parked behind its watermark, the production controller refuses before any byte when the routed provider cannot settle, and a census pins the five production IPtyProvider classes and rejects a settlement synthesized from the fire-and-forget write. Each new assertion was verified red against the pre-fix shape.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\",\"result\":\"passed\",\"durationSeconds\":8.22,\"summary\":\"245 tests passed across mailbox identity, durable coordinator-handle migration, insertion-time canonicalization, duplicate-free 51-row ownership branch caps, unrestricted reservation merging, direct and Dispatch pointer suppression, persisted reconciliation, 50-row paging and filtered waits, cross-PTY serialization, lifecycle fencing, bounded daemon and SSH transport settlement, outstanding Deliveries, reminted Dispatch ownership, acknowledgment, cancellation, and bounded pane lookup.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"result\":\"passed\",\"durationSeconds\":14.15,\"summary\":\"1,293 tests passed and 1 was skipped across Run-bound pointer delivery, PTY retirement and respawn, stale-leaf liveness, direct-mail routing, filtered waiter ownership, canonical stored-recipient notification, and orchestration RPC behavior.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1412: src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orchestration-mailbox-delivery.test.ts\",\"assertions\":[\"a refused pointer transport releases its reservation, stays undelivered, and becomes restart-retryable\",\"a dropped in-flight SSH settlement reaches the stager as unverifiable with bytes handed to the transport and emits no duplicate pointer after restart\",\"a settled write that throws mid-pointer preserves the write-attempted reservation\",\"an Enter whose settlement is lost stays at enter-attempted and restart emits no second Enter\"]}]",
        "Audit1943 (sources1934/1935/1938): Pruned notification-consistency suite loses50-row counter/wake budget and named-index EXPLAIN inventory, unbound direct-row projection and synthetic parked-decoy deadline examples. Preserve exact genuine SQLite ownership, disk-reopen/staged pointer and controlled provider-transition callbacks; fake PTY/title/clock seams do not establish actual provider delivery or measured backlog latency. Also retire three preexisting unsupported full aliases (explicit-check reservation redrive, known-PTY-exit replacement, and filtered/wait later-page draining), absent from both the frozen21and retained17callbacks. These retire stale metadata with no additional source/removal credit. Existing aliases are retained only where independently mapped below; no equivalent replacement for removed callbacks. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'does not point unbound direct mail that a later Run binding would hide'; 'pages a large persisted mismatch and coalesces each mailbox wake'; 'uses composite indexes for direct ownership reconciliation'; 'keeps a staged Enter deferred when a parked watcher republishes the leaf beside a decoy'.",
        "Audit1943 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration-mailbox-notification-consistency.test.ts\",\n          \"assertions\": [\n            \"Run A direct mail cannot point after the pane binds Run B\",\n            \"a fresh runtime cannot replay the unactionable pointer\",\n            \"a fresh runtime reconciles a database that already contains the production mismatch\",\n            \"large persisted mismatches route in 50-row pages with coalesced per-mailbox wakes\",\n            \"Run pointers pin the existing mixed-version-compatible --run identity\",\n            \"direct and Dispatch mail remain durable without unpinned synthetic terminal turns\",\n            \"a staged pointer submits once when Codex or Claude becomes working and still withholds Enter for permission\",\n            \"an explicit check releases its staged pointer reservation without redrive\",\n            \"accepted pointer text is durably deduplicated before delayed Enter and provider Enter refusal\",\n            \"a known PTY exit releases staged rows for the replacement process\",\n            \"a staged pointer follows its Run to a new live pane without cross-PTY duplication\",\n            \"equivalent panes serialize one mailbox while newer mail arrives during Enter delay\",\n            \"same-Run direct mail is delivered and acknowledged through the bound Run\",\n            \"a submitted actionable pointer is durably deduplicated across restart without marking mail read\",\n            \"newer Run mail is not pointed behind an outstanding fixed Delivery\",\n            \"same-owner filtered checks drain later 50-row pages before waiting\"\n          ]\n        }",
        "Audit1948 (Audit1946 sources 14, 26, 31, 39, 40, 47): Pruning removes scalar Run binding/projection and worker-start round-trip examples, v28 self-convergence, simple relay-type/legacy-payload and peer-probe/checkpoint cleanup examples, and reservation-failure/Cursor Enter examples. Preserve the three coordinator migration aliases, duplicate-replay waiter suppression and refused-write drain alias. The reminted-pane SQLite lookup checks active owner replacement and malformed decoys, not lookup cardinality or a performance budget. Overlapping sync uses an injected RPC/DB harness: promise coalescing and modeled checkpoint/ACK progression do not prove real durable checkpoint persistence. The complete affected combined federation receipt is retired whole; the independent unchanged CLI receipt remains in its original scope. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review.",
        "Audit1948 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-14\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-sync.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.99,\n          \"summary\": \"52 tests passed with real OrchestrationDb rows, a deliberately dropped federation acknowledgment, reconnect/restart, forward-only checkpoints, duplicate read-row wake suppression, and protocol v1/v2 lifecycle settlement replay. The broader final federation/cross-version set passed 77/77.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation/synchronization/federation-sync.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\"\n        }",
        "Audit1948 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts\",\n          \"assertions\": [\n            \"remote Dispatch attachment lookup remains bounded across pane remints and malformed suffix collisions\"\n          ]\n        }",
        "Audit1948 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration/federation/synchronization/federation-sync.test.ts\",\n          \"assertions\": [\n            \"an acknowledged duplicate replay does not wake a waiter\",\n            \"overlapping syncs preserve one durable forward-only checkpoint\"\n          ]\n        }",
        "Audit1973: Remove scalar, private-shape and projection examples and check cases whose reconciler runs manually before check. Retain actual federation lost-ack/gap and lifecycle completion-ack/replay alarms; unrelated message-delivery-identity receipt remains exact. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit2003: Remove simpler proven-absent/unknown-delivery, synchronous double-trigger and exit-cleanup examples from the stale-leaf source. Retain controlled waiter-versus-probe races, queued-row progression, same-ID stale-Enter cancellation and orphaned-snapshot fences. Provider/process observations and database rows in this source are supplied, not actual process absence or SQLite delivery durability. Preserve the independent five-case SQLite/CLI receipt only at its unchanged command. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "Retired the complete stale-title-completion-recovery CLI silent-turn case during module-layout review because it sleeps on wall-clock timers and counts internal mock writes. Its CLI timeout/mail-during-silence journey has no replacement coverage in this refactor. The three remaining hook/title cases and unrelated historical delivery-identity receipt retain their own scope; no fresh execution or equivalent replacement is claimed.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2150: Intentionally remove mock-fed provider title/presence matrices, synthetic SQL/index query inventories, obsolete window-owner equivalent-pane serialization, simple cold-park replay, and the normal-wording/unacked-next-mail callback. Whole live-agent-title-restore and bound-run-scan suites are removed and their import drivers pruned. These bounded alarms are lost without replacement-equivalence claims. Remaining actual SQL ownership, ack/paging/restart and held probe/incarnation races remain unchanged. No fresh execution or mixed-version/provider/native/remote/mobile/cross-platform evidence is claimed; dated evidenceRuns remain verbatim.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites."
      ],
      "demotionRule": "Demote or quarantine if the deterministic oracle flakes without a product or harness bug owned by orchestration."
    },
    {
      "id": "orchestration.worker-terminal-delivery",
      "title": "Workers remain visible and observable across workspace entry and app restart",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "orchestration",
      "layer": "cli-runtime-renderer-contract",
      "surfaces": [
        "Run and Dispatch mailboxes",
        "worker-start",
        "terminal creation",
        "terminal tab materialization",
        "workspace re-entry",
        "app restart with retained daemon PTYs",
        "legacy update resume fencing"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/11107#discussion_r3663321387",
        "https://github.com/stablyai/orca/issues/13858",
        "https://github.com/stablyai/orca/pull/14105",
        "https://linear.app/stably/issue/STA-4020",
        "https://linear.app/stably/issue/STA-4021",
        "https://linear.app/stably/issue/STA-4022"
      ],
      "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. Federated terminal settlement must remain replay-eligible until the worker durably acknowledges it, and identical same-outcome retries must converge idempotently. Independently updated clients and worker servers must preserve the negotiated protocol: current peers use Run-home lifecycle settlement, while protocol v1/v2 peers retain their legacy completion path without receiving newer-only fields. A federated worker may accept only the authority defined by its negotiated protocol. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
      "oracle": "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes. Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts",
        "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/cli/handlers/orchestration.test.ts",
        "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
        "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
        "src/cli/handlers/orchestration-check-identity.test.ts",
        "src/cli/handlers/orchestration-worker-cli.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts",
        "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts",
        "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
        "src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts",
        "src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts",
        "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts",
          "assertions": [
            "replays the coordinator instruction and takes its ack after the app restarts",
            "files loopback mail once under the local Dispatch Run without replacing its owner"
          ]
        },
        {
          "file": "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
          "assertions": [
            "an explicit current worker_done verdict completes without a compatibility read",
            "a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt",
            "legacy succeeded and failed reports require matching terminal Task and Dispatch state",
            "stopped or stale Dispatches cannot impersonate report settlement",
            "an idempotent retry accepts the first authoritative report from the same worker",
            "a Run-home relay rejection reaches the CLI error boundary"
          ]
        },
        {
          "file": "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
          "assertions": ["a rejected lifecycle verdict is emitted as a JSON ok=false envelope"]
        },
        {
          "file": "src/cli/handlers/orchestration-check-identity.test.ts",
          "assertions": [
            "implicit check carries the caller pane key with a potentially stale environment handle",
            "explicit legacy terminal inspection does not inherit the caller pane key"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts",
          "assertions": [
            "Run delivery resolves through a stable coordinator pane after handle remint",
            "a live handle cannot be retargeted by mismatched pane metadata"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts",
          "assertions": [
            "Dispatch delivery resolves through a stable worker pane after handle remint"
          ]
        },
        {
          "file": "src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts",
          "assertions": [
            "a v26 database gains a zeroed durable home-to-worker acknowledgment watermark",
            "a complete v26 database starts migration at v26 rather than replaying v7-v26",
            "the migration advances schema version without losing the imported relay cursor"
          ]
        },
        {
          "file": "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
          "assertions": [
            "worker-start exposes one inactive worker tab before workspace navigation",
            "the coordinator tab remains active",
            "ACK delivery reaches a stable coordinator pane through a stale handle",
            "one spawn remains live with no interruption event",
            "PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable",
            "workspace re-entry does not duplicate the worker tab or print Conversation interrupted"
          ]
        },
        {
          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
          "assertions": [
            "a compiled CLI worker_done with the wrong identity exits nonzero with ok=false",
            "the exact Task and Dispatch remain dispatched after rejection",
            "the correct worker identity receives an explicit completed lifecycle verdict",
            "an independent runtime read observes the Dispatch completed"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts --reporter=dot",
          "result": "passed",
          "durationSeconds": 0.47,
          "summary": "A complete v26 database resolved migration start at v26, upgraded to v27, retained its imported cursor, and initialized the durable acknowledgment watermark to zero.",
          "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot"
        },
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 20,
          "summary": "The combined candidate passed one real Electron and compiled-CLI journey: wrong worker identity exited nonzero with ok=false while Dispatch stayed dispatched, the exact worker received an explicit completed verdict, and runtime state independently reached completed."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 75,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "promotionCriteria": [
        "Collect 100 consecutive passes or 14 days of stable CI history on macOS, Linux, and Windows.",
        "Run distinct installed A/B artifacts through separate headed and headless paired-runtime cutover journeys, plus a git-independent folder workspace parameter.",
        "Add Docker SSH restart/reconnect proof and physical Windows WSL correct-distro/wrong-distro proof.",
        "Attach saved intentional-break artifacts for hidden local presentation and dropped stable-pane delivery."
      ],
      "knownGaps": [
        "Audit2923 accepts loss of the first/replayed attested legacy worker_done CLI acceptance alarms, including exact send parameters, sender pane proof, lifecycle-wait flag and minted mutation identity. The removed fixture supplied settled runtime verdicts; it did not execute settlement authority, durable replay or outage recovery. Reduced selectors have no new execution, fault-control or equivalent replacement credit.",
        "Audit2923 retires this entire mixed three-file receipt from current evidenceRuns because its selector included the removed migration suite. Preserved verbatim original JSON object (historical only; no reduced-selector validation):\n{\n          \"date\": \"2026-08-11\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.4,\n          \"summary\": \"Three focused files passed 12 deterministic tests covering explicit current and Run-home verdicts, JSON failure output, exact report and terminal-state verification for stripped responses, stale/stopped rejection, idempotent retry, and first/replayed attested legacy settlements.\"\n        }",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "No distinct installed A/B headed or headless paired-runtime cutover is attached; the restart journey relaunches the same build while preserving the daemon and agent.",
        "No Docker SSH restart/reconnect, physical Windows WSL distro-authority, or git-independent folder-workspace cutover journey is attached.",
        "Packaged Windows updater and uninstaller continuity is owned by separate updater reliability work and is not claimed by this gate.",
        "The Electron journey uses a deterministic fake Codex CLI rather than a real account.",
        "The local presentation journey tolerates its existing terminal-handle remint and proves continuity by PTY/incarnation/tab/leaf; byte-stable handle proof across a real A/B cutover awaits the runtime-authority/RPC implementation.",
        "The local Electron restart proof covers retained visible output from the same-build daemon checkpoint, not transcript recovery after a transport cut or distinct A/B runtime replacement.",
        "Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts\",\"result\":\"passed\",\"durationSeconds\":24.4,\"summary\":\"Test Files  1 passed (1); Tests  1445 passed | 3 skipped (1448). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"one exact live legacy worker is adopted into its original background pane without input or signals\",\"automatic provider resume stays fenced until exact adoption is persisted\",\"retained renderer output remains readable through the recovered terminal\"]}]",
        "Audit1948 (Audit1946 sources 40): The complete formatter suite and its three formatting/legacy-affordance aliases are intentionally removed. The 2026-07-28 combined 34-case formatter/federation receipt is archived whole. Distinct RPC federation-lifecycle suites, their mixed-version red/green receipts, and independent Electron/CLI selectors remain unchanged; basename similarity to deleted source34 does not make those sources or receipts part of this removal. No formatter or legacy-affordance replacement is claimed. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review.",
        "Audit1948 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration/mailbox/formatting/message-formatting.test.ts\",\n          \"assertions\": [\n            \"legacy compatibility and recovery replay show only runtime-supplied supported actions\",\n            \"legacy provenance without live authority stays read-only\",\n            \"current formatting remains unchanged\"\n          ]\n        }",
        "Audit1948 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-28\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.72,\n          \"summary\": \"Two focused files passed with 34 tests, covering authority-aware legacy affordances and federated non-reveal.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/mailbox/formatting/message-formatting.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\"\n        }",
        "Audit1973: Remove private already-aborted listener bookkeeping and scalar/projection/mock examples. Retain actual queued settlement abort to operation_unknown, v1/v2 durable terminal/replay/atomic outcomes, stable coordinator/live-handle refusal and reminted-pane stable dispatch mail. Retire8 whole dated changed-source receipts, including failures and mixed suites; preserve9 independent receipt objects and existing partial protection without transferring counts, durations or intentional-break/performance claims. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.02,\n          \"summary\": \"The 70f1d52f mixed-version oracle passed all 21 cases. Protocol v1/v2 clients started fresh workers on a current server, completed success and failure with explicit legacy authority, and automatically retried a lost ACK after Run-home restart; current-protocol settlement and duplicate-report controls stayed green.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-13\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 4.21,\n          \"summary\": \"The byte-identical 70f1d52f oracle failed 6 mixed-version cases while 15 controls passed when the fresh v1/v2 refusal was restored: success and failure through both negotiated versions plus both lost-ACK restart cases.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 5.05,\n          \"summary\": \"The byte-identical ac7bdf4e federation oracle failed 7 of 17 tests on affected 09ec516ae5: fresh v1/v2 work started before completion rejection, persisted v1/v2 work could not finish after update, same-outcome ACKs rejected, duplicate reports remained pending, and a dropped ACK was not replayed.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 5.86,\n          \"summary\": \"The same byte-identical oracle failed the same 7 of 17 tests on latest main 1136503c6a.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.28,\n          \"summary\": \"The same byte-identical oracle passed all 17 tests on candidate 008f740161, including restart replay and both directions of v1/v2 update compatibility.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 19.84,\n          \"summary\": \"With the claimed production files restored to latest main in 3a15d3ed5d, the same byte-identical oracle returned to the same 7 failures while 10 unaffected cases still passed.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-07-28\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 5.27,\n          \"summary\": \"Five focused files passed with 216 tests, covering visible inactive local worker creation, reveal-failure warnings, stable-pane mailbox routing, live-handle precedence, and SSH fallback parity.\"\n        }",
        "Audit1973 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-12\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.58,\n          \"summary\": \"Nine deterministic tests passed for protocol negotiation, Run-home completion and rejection, already-aborted waits, authoritative remote-attachment settlement bound to the exact queued worker_done outcome, and exact verdict replay after lost acknowledgments without mutating durable rejection mail twice.\"\n        }",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\n          \"assertions\": [\n            \"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint\",\n            \"protocol v1/v2 clients can start fresh workers and complete success or failure on a current worker server\",\n            \"protocol v1/v2 completion ACK loss replays safely after a Run-home restart without newer-only wire fields\",\n            \"a current Run home still completes reports from legacy protocol v1/v2 worker servers\",\n            \"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates\",\n            \"the existing relay polling path retries a committed settlement across Run-home restarts until the worker acknowledgment watermark advances\",\n            \"identical pending reports coalesce to one relay and every caller receives the same Run-home verdict\",\n            \"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing\",\n            \"an aborted settlement wait returns operation_unknown instead of accepted success\",\n            \"an already-aborted signal registers no settlement waiter\",\n            \"a Run-home terminal verdict settles the remote attachment and revokes its capability\",\n            \"a terminal verdict cannot settle an unrelated relay item\",\n            \"a terminal verdict cannot contradict the exact queued worker report outcome\",\n            \"a rejected report replays its exact verdict without mutating durable rejection mail twice\"\n          ]\n        }",
        "Audit1983: Remove visible-presentation and renderer-reveal warning aliases, ordinary status-mail and mocked remote attachment claims. Retain bounded completion replay, attested takeover and wrong-pane fencing aliases. Retire4 whole dated changed-source receipts, including failures, preserving5 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts\",\n          \"assertions\": [\n            \"same-workspace worker creation uses visible inactive presentation\",\n            \"worker-start preserves and reports renderer reveal failures\"\n          ]\n        }",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts\",\n          \"assertions\": [\n            \"an exact current worker settles once through an app/runtime update even when renderer graph identity is absent\",\n            \"only an attested current coordinator may explicitly take over retained live work\",\n            \"Task, Dispatch, terminal authority, completion, and filesystem bytes are neither lost nor duplicated\",\n            \"foreign pane evidence cannot borrow retained lifecycle authority\",\n            \"ordinary mail and remote attachments use the same attested pane and process authority\"\n          ]\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3.07,\n          \"summary\": \"The byte-identical 5f45c270f1 oracle, applied as the sole tree overlay in 063340a8ba on origin/main@34291f07e9, failed 3 of 5 rows: completion remained dispatched, takeover lacked a stable pane, and remote attachment authority lost process identity.\"\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.13,\n          \"summary\": \"The same byte-identical oracle passed 5 tests on candidate@2748b0b29b, exercising the production verifier and fresh-runtime replay while preserving exact DB identity and unchanged fixture bytes.\"\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot\",\n          \"result\": \"failed\",\n          \"durationSeconds\": 3.14,\n          \"summary\": \"With current-authority propagation actually disabled in candidate child 08a7db37bf, the same byte-identical oracle failed 2 of 5 rows: completion remained dispatched and remote attachment authority was rejected.\"\n        }",
        "Audit1983 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.1,\n          \"summary\": \"After reverting the intentional break in d2a4e2e024, the same byte-identical oracle passed all 5 tests.\"\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts are retired below as historical raw objects; their counts do not validate reduced commands. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-28\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.3,\n          \"summary\": \"The isolated Electron journey passed with one live fake-agent spawn, no interruption events, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, immediate inactive presentation, pane-stable ACK delivery, and exactly one tab after workspace re-entry.\"\n        } Historical retired receipt verbatim:\n{\n          \"date\": \"2026-07-28\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 12.6,\n          \"summary\": \"The restart journey retained one daemon PTY and PID, adopted its exact original background pane, preserved readable ACK output and Task/Dispatch authority, cleared all resume state, and recorded no second spawn, resume argv, input, signal, interruption, or duplicate after workspace re-entry.\"\n        }",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\n        \"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1\",\n        \"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"\n      ]\ntestFiles: [\n        \"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/cli/handlers/orchestration.test.ts\",\n        \"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\n        \"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\n        \"src/cli/handlers/orchestration-check-identity.test.ts\",\n        \"src/cli/handlers/orchestration-worker-cli.test.ts\",\n        \"src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts\",\n        \"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\n        \"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\n        \"src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\n        \"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\n        \"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\n        \"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\n        \"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\n          \"assertions\": [\n            \"replays the coordinator instruction and takes its ack after the app restarts\",\n            \"files loopback mail once under the local Dispatch Run without replacing its owner\"\n          ]\n        },\n        {\n          \"file\": \"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\n          \"assertions\": [\n            \"an explicit current worker_done verdict completes without a compatibility read\",\n            \"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt\",\n            \"legacy succeeded and failed reports require matching terminal Task and Dispatch state\",\n            \"stopped or stale Dispatches cannot impersonate report settlement\",\n            \"an idempotent retry accepts the first authoritative report from the same worker\",\n            \"a Run-home relay rejection reaches the CLI error boundary\"\n          ]\n        },\n        {\n          \"file\": \"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\n          \"assertions\": [\"a rejected lifecycle verdict is emitted as a JSON ok=false envelope\"]\n        },\n        {\n          \"file\": \"src/cli/handlers/orchestration-check-identity.test.ts\",\n          \"assertions\": [\n            \"implicit check carries the caller pane key with a potentially stale environment handle\",\n            \"explicit legacy terminal inspection does not inherit the caller pane key\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\n          \"assertions\": [\n            \"Run delivery resolves through a stable coordinator pane after handle remint\",\n            \"a live handle cannot be retargeted by mismatched pane metadata\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\n          \"assertions\": [\n            \"Dispatch delivery resolves through a stable worker pane after handle remint\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\n          \"assertions\": [\n            \"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint\",\n            \"a current Run home still completes reports from legacy protocol v1/v2 worker servers\",\n            \"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates\",\n            \"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing\",\n            \"an aborted settlement wait returns operation_unknown instead of accepted success\",\n            \"a Run-home terminal verdict settles the remote attachment and revokes its capability\",\n            \"a terminal verdict cannot settle an unrelated relay item\",\n            \"a terminal verdict cannot contradict the exact queued worker report outcome\",\n            \"a rejected report replays its exact verdict without mutating durable rejection mail twice\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\n          \"assertions\": [\n            \"a v26 database gains a zeroed durable home-to-worker acknowledgment watermark\",\n            \"a complete v26 database starts migration at v26 rather than replaying v7-v26\",\n            \"the migration advances schema version without losing the imported relay cursor\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\n          \"assertions\": [\n            \"worker-start exposes one inactive worker tab before workspace navigation\",\n            \"the coordinator tab remains active\",\n            \"ACK delivery reaches a stable coordinator pane through a stale handle\",\n            \"one spawn remains live with no interruption event\",\n            \"PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable\",\n            \"workspace re-entry does not duplicate the worker tab or print Conversation interrupted\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\n          \"assertions\": [\n            \"a compiled CLI worker_done with the wrong identity exits nonzero with ok=false\",\n            \"the exact Task and Dispatch remain dispatched after rejection\",\n            \"the correct worker identity receives an explicit completed lifecycle verdict\",\n            \"an independent runtime read observes the Dispatch completed\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. The complete federation-lifecycle-settlement suite is removed, losing its fake remote settlement/protocol/acknowledgment examples. Its exact standalone command, testFiles entry and complete assertionRef are retired and prior fields archived. Existing receipts select unrelated migration and compiled CLI journeys and retain original scopes.  All prior notes and dated/archived evidence retain original scopes.",
        "Complete prior commands before federation-lifecycle suite retirement: [\"ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/construction/orca-runtime.test.ts\",\"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1\",\"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"]",
        "Complete prior testFiles before federation-lifecycle suite retirement: [\"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"src/main/runtime/construction/orca-runtime.test.ts\",\"src/cli/handlers/orchestration.test.ts\",\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"src/cli/handlers/orchestration-check-identity.test.ts\",\"src/cli/handlers/orchestration-worker-cli.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts\",\"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts\",\"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\"]",
        "Complete prior assertionRefs before federation-lifecycle suite retirement: [{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts\",\"assertions\":[\"replays the coordinator instruction and takes its ack after the app restarts\",\"files loopback mail once under the local Dispatch Run without replacing its owner\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-rejection.test.ts\",\"assertions\":[\"an explicit current worker_done verdict completes without a compatibility read\",\"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt\",\"legacy succeeded and failed reports require matching terminal Task and Dispatch state\",\"stopped or stale Dispatches cannot impersonate report settlement\",\"an idempotent retry accepts the first authoritative report from the same worker\",\"a Run-home relay rejection reaches the CLI error boundary\"]},{\"file\":\"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts\",\"assertions\":[\"a rejected lifecycle verdict is emitted as a JSON ok=false envelope\"]},{\"file\":\"src/cli/handlers/orchestration-check-identity.test.ts\",\"assertions\":[\"implicit check carries the caller pane key with a potentially stale environment handle\",\"explicit legacy terminal inspection does not inherit the caller pane key\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"assertions\":[\"Run delivery resolves through a stable coordinator pane after handle remint\",\"a live handle cannot be retargeted by mismatched pane metadata\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts\",\"assertions\":[\"Dispatch delivery resolves through a stable worker pane after handle remint\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts\",\"assertions\":[\"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint\",\"a current Run home still completes reports from legacy protocol v1/v2 worker servers\",\"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates\",\"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing\",\"an aborted settlement wait returns operation_unknown instead of accepted success\",\"a Run-home terminal verdict settles the remote attachment and revokes its capability\",\"a terminal verdict cannot settle an unrelated relay item\",\"a terminal verdict cannot contradict the exact queued worker report outcome\",\"a rejected report replays its exact verdict without mutating durable rejection mail twice\"]},{\"file\":\"src/main/runtime/orchestration/db/federation/federation-acknowledgment-migration.test.ts\",\"assertions\":[\"a v26 database gains a zeroed durable home-to-worker acknowledgment watermark\",\"a complete v26 database starts migration at v26 rather than replaying v7-v26\",\"the migration advances schema version without losing the imported relay cursor\"]},{\"file\":\"tests/e2e/orchestration-worker-terminal-visibility.spec.ts\",\"assertions\":[\"worker-start exposes one inactive worker tab before workspace navigation\",\"the coordinator tab remains active\",\"ACK delivery reaches a stable coordinator pane through a stale handle\",\"one spawn remains live with no interruption event\",\"PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable\",\"workspace re-entry does not duplicate the worker tab or print Conversation interrupted\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"a compiled CLI worker_done with the wrong identity exits nonzero with ok=false\",\"the exact Task and Dispatch remain dispatched after rejection\",\"the correct worker identity receives an explicit completed lifecycle verdict\",\"an independent runtime read observes the Dispatch completed\"]}]"
      ],
      "demotionRule": "Keep experimental or demote if either Electron journey flakes without a product or harness defect, if local worker-start can return before tab materialization without an explicit reveal warning, if focus moves to the worker, if restart or workspace re-entry spawns/resumes/duplicates/interferes with the worker, if retained output becomes unreadable, or if pane-stable delivery reads the wrong mailbox."
    },
    {
      "id": "orchestration.context-only-dispatch-release",
      "title": "Manual Dispatch release fences assignments without stopping unsupervised terminals",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "orchestration",
      "layer": "cli-runtime-sqlite-terminal-lifecycle",
      "surfaces": [
        "orchestration dispatch",
        "dispatch-show",
        "worker-abandon",
        "worker-stop",
        "manual terminal reuse"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "NEXT136 retains only unchanged execution receipts at their original scopes. Reduced-source selectors and retained static assertions have no new execution or equivalent replacement credit.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/13005",
        "https://github.com/stablyai/orca/pull/13250"
      ],
      "invariant": "A live Dispatch created by orchestration dispatch can be stopped or abandoned even though it has no supervised worker row. Release must durably record the requested outcome, revoke lifecycle authority, close questions, free the exact assignee identity, and block only the Task whose current Dispatch was released. It must never close the unsupervised terminal process, disturb unrelated or supervised workers, or let a repeat or opposite verb rewrite the persisted outcome.",
      "oracle": "Retained assertion references and unchanged receipts keep their original scopes; retired callbacks and archived receipts provide no current coverage.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot",
        "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts",
        "src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
        "src/cli/handlers/orchestration-worker-cli.test.ts",
        "tests/e2e/orchestration-low-level-dispatch-release.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts",
          "assertions": [
            "worker-abandon and worker-stop durably release context-only Dispatches without closing terminals",
            "repeat and cross-verb calls preserve the first stored outcome",
            "superseded release frees only the old identity and leaves the current Task Dispatch active",
            "unrelated and supervised workers remain unchanged"
          ]
        },
        {
          "file": "tests/e2e/orchestration-low-level-dispatch-release.spec.ts",
          "assertions": [
            "dispatch-show returns the live manual Dispatch before release",
            "abandon and stop record distinct durable outcomes",
            "the exact PTY and incarnation survive worker-stop",
            "the same pane accepts a third Dispatch after both releases"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-09",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "failed",
          "durationSeconds": 4.3,
          "summary": "Current main 2dc172f666 reproduced issue #13005: dispatch-show returned the live id, then worker-abandon failed with dispatch_not_found before any release or pane reuse could occur."
        },
        {
          "date": "2026-08-09",
          "runner": "local",
          "platform": "macos",
          "command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 4.1,
          "summary": "The isolated Electron journey passed both release verbs, preserved the exact pane PTY/incarnation, and dispatched a third Task to the same terminal."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history on macOS, Linux, and Windows.",
        "Add isolated headed and headless paired-runtime journeys against mixed client and host versions.",
        "Add Docker SSH and physical Windows WSL same-pane reuse evidence."
      ],
      "knownGaps": [
        "Live paired-runtime, headless serve, SSH, WSL, Linux, and Windows evidence is not yet attached.",
        "The Electron journey calls production runtime RPC methods directly instead of spawning a separate CLI process.",
        "The local journey covers a folder-backed seeded repository through the app fixture but not a git-independent folder workspace.",
        "Audit1948 (Audit1946 sources 31): The complete 2026-08-09 combined unit receipt is archived after the worker-dispatch DB suite changes. Removed composed-start/create/mutation-acceptance and residual-receipt examples lose their separate alarms. Retained current-terminal/superseded/stop-fence/recovery transitions remain authored, while this gate’s independent manual-release/CLI/Electron aliases and two unchanged dated Electron receipts keep their original scopes. No historical passed receipt is narrowed or transferred to changed source bytes. Unchanged dated receipts and retained assertions keep only their original independently mapped scopes. No fresh execution, equivalent replacement, physical PTY/provider, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata review.",
        "Audit1948 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-09\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.38,\n          \"summary\": \"Five focused files passed 60 tests, including both context-only release verbs, stale/current ownership, question closure, repeat and cross-verb idempotency, supervised controls, terminal-close negative assertions, and text-mode retained-process guidance.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts src/main/runtime/orchestration/db/worker-dispatch/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot\"\n        }",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims."
      ],
      "demotionRule": "Keep experimental or demote if release closes an unsupervised terminal, rewrites a durable outcome, blocks a newer Task Dispatch, leaves an assignee identity occupied, or the focused oracle flakes without a product or harness defect."
    },
    {
      "id": "orchestration.settled-worker-terminal-release",
      "title": "Settled worker cleanup preserves one exact terminal lease and immutable output",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "orchestration",
      "layer": "runtime-sqlite-terminal-lifecycle",
      "surfaces": [
        "worker-release",
        "worker-retain",
        "explicit terminal reuse",
        "restart reconciliation",
        "worker-read archives",
        "orchestration reset"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": [],
      "coverageNotes": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Audit1379 changes src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts (7 authored registrations removed; 0 retained). Intentional losses: Loses supplied host lists and record states mapped to liveness enums and routing counts; no live/dead process evidence. No equivalent replacement coverage is claimed. Remaining exact receipts validate only their unchanged selectors. Historical coverage account: Only Keep open keeps a worker; a phone or desktop names it by handle, pane or session, and older clients' typing reports record nothing. Host byte lanes perform zero orchestration SQL work; local and injected SSH Keep open tests fence release. Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, host-partition persistence and legacy retirement replay with an absent web-terminal layout map, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps. Audit1396: src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts reduced. Retires unary/stream no-database-work call counts and three mobile RPC allowlist membership checks. Ancillary input delivery assertions in the budget registration intentionally lost without equivalence claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/12355",
        "https://github.com/stablyai/orca/issues/13860",
        "STA-905",
        "STA-3932",
        "STA-5122"
      ],
      "invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, Keep open, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Once the authoritative owning provider positively excludes the resource's exact immutable process incarnation, even an external, user-owned, or transferred dead resource must converge to released without any process close. Unknown host scope, missing incarnation metadata, or unavailable inventory must remain retained. Exact terminal-close persistence must settle when a host partition omits renderer-owned layout state. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
      "oracle": "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes. Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet. Historical prior account (preserved verbatim): Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Surviving unchanged-source receipts are the current oracle; changed-source assertions await validation. Historical oracle account: Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain against a controlled archive promise and require no committed archive or close. Rebase a closed web-terminal host partition without terminalLayoutsByTabId and require the persistence write to complete while preserving host-authoritative membership; replay a valid legacy retirement under the same omission and require exact membership removal plus revision advancement. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
      "commands": [
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts src/main/runtime/terminal/identity/orca-runtime-terminal-handle-incarnation.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot",
        "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts",
        "src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts",
        "src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
        "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts",
        "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
        "src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts",
        "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts",
          "assertions": [
            "rebases a host partition that no longer carries the closed web-terminal layout",
            "replays a legacy retirement when its host partition omits terminal layouts"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts",
          "assertions": [
            "retains a dead external terminal without closing a process",
            "releases a dead stopped or abandoned worker without closing a process",
            "lets an explicit retain cancel a release while output capture is pending"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts",
          "assertions": [
            "finishes a requested release after restart-style interruption within the same runtime and database",
            "coalesces reconciliation joining an interactive release into one recorded recovery attempt and one terminal close"
          ]
        },
        {
          "file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
          "assertions": [
            "compiled worker-release reconciles a dead external retained resource to released",
            "the CLI reports processAction none instead of closing a process",
            "SQLite independently records released ownership and release state",
            "the unrelated coordinator terminal remains live"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-12",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 20,
          "summary": "The combined candidate's compiled worker-release returned released with processAction none after positive process absence; an independent SQLite read showed both states released and the coordinator terminal remained live."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical prior-selector runtime budget; changed selector has no fresh runtime measurement. Unchanged receipts retain their own command scope."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1379 reduced selector has no fresh soak result. Historical account: Repeated local deterministic runs pass; focused CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1379 changes test sources; reduced selector has no fresh red/green result. Historical account: The version-skew legacy-retirement test deterministically threw at mobile-session-terminal-persistence-retirement.ts:75 before the null-safe layout read and passed with exact tab removal, tombstone cleanup, and topology-revision advancement after the fix. The byte-identical compiled-CLI Electron oracle left the dead resource external/retained on latest main 5ea7df1a5b, passed on combined candidate d697666ce8 with released/released SQLite state and processAction none, and reproduced external/retained after disabling the claimed production files at merge-base 64aec94cb2. The earlier unchanged three-case dead external/user-owned/transferred service oracle likewise failed 3/3 on main, passed 3/3 on candidate, and failed 3/3 with production restored; every run asserted durable state and zero terminal close calls. The 320-live-PTY oracle failed on the prior single-map implementation and passes with complete active evidence, zero detached history, and a linear identity-check bound after the cache split."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Historical prior-selector budget; reduced selector has no fresh measurement. Previous account: Normal owned release performs constant-count indexed resource and identity queries plus one bounded archive capture. Missing layout maps use constant-time empty-record fallbacks inside the existing explicit persistence pass, with no added scan or allocation proportional to terminal history. A retained release performs exactly one bounded inventory against its authoritative local/WSL or specific SSH provider, with no retry, polling, timer, subprocess, renderer subscription, or per-session follow-up fanout. Each liveness observation performs constant-time active-identity classification; retirement performs one historical insertion and at most one oldest-entry eviction, while active evidence scales only with supported PTYs and detached history is capped at 256. Worker-list uses two set queries rather than one resource lookup per worker."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Add live headed and headless paired-runtime release/reuse journeys.",
        "Add Docker SSH reconnect and physical Windows WSL host-scope evidence.",
        "Prove provider-close lost acknowledgements converge with an exact durable close receipt."
      ],
      "knownGaps": [
        "Provider close has no durable cross-process operation receipt, so a crash after host mutation but before SQLite settlement remains release_pending until exact inventory returns.",
        "Federated release remains explicitly unsupported and retained.",
        "Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised; the host-partition fix changes persistence normalization only, not ConPTY, filesystem, update, sleep, firewall, or window lifecycle semantics.",
        "Audit1379 changes src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts (7 authored registrations removed; 0 retained). Intentional losses: Loses supplied host lists and record states mapped to liveness enums and routing counts; no live/dead process evidence. No equivalent replacement coverage is claimed.",
        "Audit1379 retires this complete actual-current dated receipt because its selector includes a deleted or reduced source. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-27\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.78,\n          \"summary\": \"Seven deterministic files passed 78 tests, including red-green host-partition rebase and legacy-retirement regressions with an absent web-terminal layout map plus exact lease, reuse, takeover, recovery, restart, archive, and accounting contracts.\"\n        }",
        "Audit1379 retires this complete actual-current dated receipt because its selector includes a deleted or reduced source. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-11\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4.98,\n          \"summary\": \"Six focused files passed 67 tests on the rebased candidate, covering dead external, user-owned, stopped, abandoned, and transferred reconciliation; exact local/WSL/SSH provider routing; malformed, missing, and unavailable inventory retention; zero process closes; existing lease, archive, recovery, mutation, and renderer-input contracts.\"\n        }",
        "Audit1379 historical platform/provider scope: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"ssh\"]}. Remaining evidence applies to unchanged-source commands only.",
        "Audit1379 historical assertion inventory for reduced/deleted sources:\n[\n  {\n    \"file\": \"src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts\",\n    \"assertions\": [\n      \"classifies only an exact incarnation as live on its owning provider\",\n      \"keeps missing or malformed identity and unavailable inventory unknown\",\n      \"does not inspect an unproven host scope\",\n      \"uses the local provider inventory for local and WSL scopes\"\n    ]\n  }\n]",
        "Audit1396: src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts reduced. Retires unary/stream no-database-work call counts and three mobile RPC allowlist membership checks. Ancillary input delivery assertions in the budget registration intentionally lost without equivalence claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts\",\"assertions\":[\"a handle-addressed phone Keep open fences %s worker release\",\"mobile %s bytes do no orchestration database work\"]}]",
        "Audit1959 (sources 1955:34): Pruning removes unsupported-provider/out-of-range scalar refusals and the single Grok happy decoder fixture. Retain actual file cursor append/paging, same-inode checkpoint invalidation, opaque IDs and oversized-line progress. Retire the complete dated 3.48s combined receipt through its effective currentCommand, without changing its original command or transferring its 56-test result. Unchanged CLI/Electron receipt retains its independent scope. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet.",
        "Audit1959 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.48,\n          \"summary\": \"Five focused files passed 56 tests covering lease serialization, reminted-handle transfer, duplicate-identity fencing, retain and takeover races, immutable archives, conservative legacy migration, mutation restart, reset cleanup, bounded accounting, and renderer input reporting.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\"\n        }",
        "Audit1983: Remove unsupported user-taken-over, transferred-owner, exact-reuse, host-scope, immutable-transcript, legacy-ambiguity, reset and50-worker aliases from their claimed sources. Remove the deleted pending-release ledger replay alias. Narrow surviving external-retention and recovery aliases to actual retained callbacks; no transfer to another file or process-restart proof. Preserve the independent receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\n          \"assertions\": [\n            \"reconciles a dead external terminal without closing a process\",\n            \"reconciles a dead user-taken-over terminal without closing a process\",\n            \"reconciles a dead stopped or abandoned worker without closing a process\",\n            \"reconciles dead transferred ownership after the current owner settles\",\n            \"rejects exact reuse after release intent instead of closing the new worker\",\n            \"lets an explicit retain cancel a release while output capture is pending\",\n            \"retains when the terminal host scope changed instead of closing\",\n            \"reads an immutable transcript snapshot after the provider file disappears\",\n            \"backfills a legacy creator plus explicit reuser as ambiguous\",\n            \"removes terminal authority and archived output on orchestration reset\"\n          ]\n        }",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/orchestration-mutation-ledger.test.ts\",\n          \"assertions\": [\"resumes a pending idempotent worker release after restart\"]\n        }",
        "Audit1983 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\n          \"assertions\": [\n            \"finishes a requested release after restart-style interruption\",\n            \"coalesces overlapping reconciliation passes and closes each resource once\",\n            \"keeps live terminals bounded across 50 settled workers while controls survive\"\n          ]\n        }",
        "Audit2003: Remove3 preexisting unsupported320-live-PTY,400-retirement/256-history and replacement-lifecycle aliases from the inventory driver: neither its frozen original imported registrars nor proposed candidate owns those callbacks. This metadata correction adds no test-removal credit. The driver loses the empty-worktree-publication suite and3 folder-host/unverifiable scalar examples while retaining concurrent inventory freshness and provider-failure verdict fences. The retained inventory callbacks are not terminal-release, historical-cache capacity or performance-budget replacement coverage. Preserve the independent compiled-CLI Electron receipt exactly. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit2003 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\n          \"assertions\": [\n            \"320 simultaneously live PTYs retain truthful verdicts with linear identity checks and no detached history\",\n            \"400 unresolved PTY retirements preserve active doubt while bounding history at 256 entries\",\n            \"a replacement lifecycle clears the retained historical verdict for the reused PTY id\"\n          ]\n        }",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Lose the complete completed-worker-retirement-resume suite: exact terminal-close resume-record revocation, PTY-exit recovery retention and settled-worker release examples. Remove its exact command token or standalone command, testFiles entry and assertionRef, archiving complete prior fields. Independent receipts retain original scopes.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 complete prior commands before completed-worker-retirement-resume retirement: [\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts src/main/runtime/terminal/identity/orca-runtime-terminal-handle-incarnation.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts --reporter=dot\",\"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose\",\"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"]",
        "Audit3437 complete prior testFiles before completed-worker-retirement-resume retirement: [\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts\",\"src/main/runtime/terminal/query/runtime-terminal-inventory-contracts.test.ts\",\"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\"src/main/runtime/rpc/orchestration-mutation-ledger.test.ts\",\"src/main/runtime/orchestration/workers/transcripts/worker-transcript-read.test.ts\",\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\"]",
        "Audit3437 complete prior assertionRefs before completed-worker-retirement-resume retirement: [{\"file\":\"src/main/runtime/terminal/surface/mobile-session-terminal-persistence-retirement.test.ts\",\"assertions\":[\"rebases a host partition that no longer carries the closed web-terminal layout\",\"replays a legacy retirement when its host partition omits terminal layouts\"]},{\"file\":\"tests/e2e/completed-worker-retirement-resume.unit.test.ts\",\"assertions\":[\"an already-exited succeeded Dispatch reaches released while its late exact close revokes the missing tab's stale resume record\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts\",\"assertions\":[\"retains a dead external terminal without closing a process\",\"releases a dead stopped or abandoned worker without closing a process\",\"lets an explicit retain cancel a release while output capture is pending\"]},{\"file\":\"src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts\",\"assertions\":[\"finishes a requested release after restart-style interruption within the same runtime and database\",\"coalesces reconciliation joining an interactive release into one recorded recovery attempt and one terminal close\"]},{\"file\":\"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts\",\"assertions\":[\"compiled worker-release reconciles a dead external retained resource to released\",\"the CLI reports processAction none instead of closing a process\",\"SQLite independently records released ownership and release state\",\"the unrelated coordinator terminal remains live\"]}]"
      ],
      "demotionRule": "Keep experimental or demote if release can overlap exact reuse, close a conflicting lease, lose immutable output, retain reset archives, fan out per worker, or any focused ordering test flakes without a product or harness defect."
    },
    {
      "id": "terminal-render.windows-cjk-repaint",
      "title": "Windows ConPTY wide glyphs and cursor rewrites repaint without stale cells",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "windows-electron-conpty",
      "surfaces": [
        "Windows ConPTY",
        "CJK",
        "emoji",
        "wide glyphs",
        "cursor repaint",
        "rewrite output"
      ],
      "platforms": ["windows"],
      "providers": ["local", "daemon", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6876",
        "https://github.com/stablyai/orca/pull/6968",
        "https://github.com/stablyai/orca/pull/6970"
      ],
      "invariant": "Windows terminal repaint must not leave stale cells, clipped wide glyphs, or hidden cursor state after CJK, emoji, or cursor-rewrite output.",
      "oracle": "A Windows gate combines xterm buffer assertions with bounded screenshot/canvas evidence for representative CJK, emoji, and rewrite sequences.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Windows focused Electron render gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Gate is registered as a known Windows rendering gap; no command is wired."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break proof for stale wide-glyph repaint or cursor restore."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Must record refresh count or frame budget so repaint fixes do not mask excessive redraw churn."
      },
      "promotionCriteria": [
        "Use buffer/cell evidence as the primary oracle and screenshots as diagnostics.",
        "Keep stress cases non-blocking until Windows runtime history is stable.",
        "Fail promotion on silent Windows environment skips."
      ],
      "knownGaps": ["No manifest command yet.", "No Windows CJK/emoji repaint command is wired."],
      "demotionRule": "Cannot promote if the oracle is screenshot-only or environment-skipped."
    },
    {
      "id": "terminal-render.foreground-repair-span",
      "title": "A forced foreground repaint covers every row the write changed",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-unit",
      "surfaces": [
        "foreground PTY output",
        "in-place agent redraws",
        "erase-in-line/display",
        "alternate screen",
        "scroll",
        "wide glyphs"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2615: all retained source alarms retired. No retained source coverage or current source oracle remains for this gate. Prior notes and dated evidence are historical only; no equivalent replacement or fresh evidence is claimed. Audit2236: retire the21-profile real-parser row-change corpus and bottom-row narrowing bound. Retain one controlled hardcoded dirty-span case proving pre/post cursor inclusion. No retained case proves real-parser changed-row convergence, viewport-scroll/alternate-screen full-grid fallback, work bounds or pixel behavior. Historical dated parser/CDP/red-green/performance evidence remains verbatim history and does not validate reduced source bytes; no equivalent replacement or fresh evidence is claimed. Historical prior account (preserved verbatim): Renderer-unit convergence corpus over a real xterm parser, plus manual CDP pixel evidence on the macOS WebGL renderer. The repaint span is provider-independent because it is computed from xterm's parse, not from the transport; SSH/WSL/remote were not exercised live. The audit removes isolated unobservable-span fallback and follow-up full-grid repaint examples. The retained real-parser corpus checks observed row changes and cursor spans; it does not establish those removed fallback alarms.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/2669",
        "https://github.com/stablyai/orca/pull/4669",
        "https://github.com/stablyai/orca/pull/8178"
      ],
      "invariant": "The row span Orca asks xterm to repaint after a forced foreground refresh must cover every viewport row whose rendered content changed during that write, plus the cursor row before and after it; when the span cannot be established — unobservable parse, viewport scroll, or a normal/alternate buffer flip — the whole viewport must be repainted.",
      "oracle": "Audit2615: all retained source alarms retired. No retained source coverage or current source oracle remains for this gate. Prior notes and dated evidence are historical only; no equivalent replacement or fresh evidence is claimed. Audit2236: retire the21-profile real-parser row-change corpus and bottom-row narrowing bound. Retain one controlled hardcoded dirty-span case proving pre/post cursor inclusion. No retained case proves real-parser changed-row convergence, viewport-scroll/alternate-screen full-grid fallback, work bounds or pixel behavior. Historical dated parser/CDP/red-green/performance evidence remains verbatim history and does not validate reduced source bytes; no equivalent replacement or fresh evidence is claimed. Historical prior account (preserved verbatim): A real @xterm/headless parser replays an adversarial corpus (in-place bottom-row redraws, standalone CR overwrite, backspace, erase-in-line, erase-in-display above and below the cursor, full clear, wide CJK, emoji, combining marks, ZWJ sequences, scroll-region insert/delete, reverse index, DEC 2026 frames, alternate-screen enter and exit, viewport scroll, narrow panes). Each viewport row is serialized cell-by-cell with its attributes before and after the write, and every row that differs must fall inside the span the settle path requested. A vacuity guard asserts each case actually moves the screen.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Renderer-unit convergence corpus"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "New deterministic gate; no soak history yet."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Narrowing the span to the cursor rows alone (dropping xterm's parse span) fails the claude-style in-place redraw and erase-in-display-above cases; reading buffer indices instead of viewport rows made the corpus vacuous and is now blocked by the changed-row guard."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Measured on a focused, visible 4-pane macOS dev build under an agent-style in-place redraw load: rendered cells/s 157,708 -> 30,139 and forEachDecorationAtCell 320,868/s -> 60,652/s with render frames/s unchanged (59.8 -> 60.5)."
      },
      "promotionCriteria": [
        "Add Windows DOM-renderer coverage for the synchronous repair branch.",
        "Wire pixel or cell evidence for the alternate-screen and reflow paths into CI rather than manual CDP runs.",
        "Keep a full-grid fallback assertion for every new span-narrowing condition."
      ],
      "knownGaps": [
        "Audit2615: all retained source alarms retired. No retained source coverage or current source oracle remains for this gate. Prior notes and dated evidence are historical only; no equivalent replacement or fresh evidence is claimed.",
        "Audit2236: retire the21-profile real-parser row-change corpus and bottom-row narrowing bound. Retain one controlled hardcoded dirty-span case proving pre/post cursor inclusion. No retained case proves real-parser changed-row convergence, viewport-scroll/alternate-screen full-grid fallback, work bounds or pixel behavior. Historical dated parser/CDP/red-green/performance evidence remains verbatim history and does not validate reduced source bytes; no equivalent replacement or fresh evidence is claimed.",
        "No CI-wired pixel oracle; WebGL convergence evidence was collected manually over CDP.",
        "Windows ConPTY synchronous repair has no retained parser-corpus or Windows-runner coverage after the corpus retirement.",
        "SSH/WSL/remote providers were not exercised live; the span is transport-independent by construction.",
        "The audit removes isolated unobservable-span fallback and follow-up full-grid repaint examples, and retires the real-parser corpus. The surviving controlled cursor-span case does not establish those fallback alarms or real-parser convergence.",
        "Audit2615 historical evidenceRuns only; no current protection. Original JSON verbatim:\n[\n        {\n          \"date\": \"2026-09-02\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-foreground-repair-convergence.test.ts\",\n          \"durationSeconds\": 1,\n          \"summary\": \"25 cases passed against a real xterm parser; paired CDP run on a 4-pane macOS WebGL dev build produced screenshots byte-identical to a forced full model rebuild.\"\n        }\n      ]"
      ],
      "demotionRule": "Demote or block if a narrowing condition is added without a matching convergence case, if the corpus stops asserting that each case changes at least one row, or if a repaint regression is reported for in-place agent redraws."
    },
    {
      "id": "terminal-shell.windows-resolution-parity",
      "title": "Windows local and daemon providers resolve shells and startup commands consistently",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-platform",
      "layer": "provider-contract-windows",
      "surfaces": [
        "shell resolution",
        "startup command",
        "cwd",
        "environment",
        "local provider",
        "daemon provider"
      ],
      "platforms": ["windows"],
      "providers": ["local", "daemon", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6541",
        "https://github.com/stablyai/orca/pull/6858"
      ],
      "invariant": "Windows local and daemon terminals must resolve equivalent shell paths, args, cwd, env, startup command delivery, and fallback behavior for PowerShell 5/7, cmd, Git Bash, WSL, and missing pwsh.",
      "oracle": "Provider-contract fixtures compare resolved command descriptors and live shell markers for supported Windows shells across local and daemon providers.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Windows provider-contract gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Gate is registered as a known Windows shell parity gap; no command is wired."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break proof for mismatched daemon/local shell resolution or lost startup command."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Required if resolution adds probing or PATH scans on hot startup paths."
      },
      "promotionCriteria": [
        "Start with provider-contract fixtures before live Electron coverage.",
        "Cover missing-shell fallback explicitly.",
        "Fail promotion on silent Windows environment skips."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "No local-vs-daemon Windows shell parity command is wired."
      ],
      "demotionRule": "Cannot promote if local and daemon provider behavior are tested separately without parity assertions."
    },
    {
      "id": "terminal-performance.input-throughput",
      "title": "Terminal input latency and throughput stay inside explicit budgets",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-performance",
      "layer": "electron-perf",
      "surfaces": [
        "typing latency",
        "output throughput",
        "hidden output",
        "renderer CPU",
        "resize churn"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7002",
        "https://github.com/stablyai/orca/pull/6858"
      ],
      "invariant": "Terminal typing, paste, resize, and output rendering must stay within latency and throughput budgets under realistic active and hidden-output load.",
      "oracle": "Perf artifacts record median/p95/max key latency, event-loop delay, renderer CPU, output bytes/sec, resize count, hidden restore latency, queue depth, and dropped-output counts.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused terminal perf report gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Existing terminal perf scripts exist, but this gate is not wired with budgets or artifacts."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break proof for hot-path listing, unbounded scheduler work, and input starvation."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Suggested initial budgets: active key median <=75ms, worst <=300ms in perf scenarios, dropped output 0, and bounded queue depths recorded per run."
      },
      "promotionCriteria": [
        "Wire existing perf scripts to emit machine-readable artifacts.",
        "Make budgets platform-aware before blocking.",
        "Do not promote stress variants until runtime history is stable."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "Existing perf scripts are not registered with explicit budgets or flake history."
      ],
      "demotionRule": "Cannot promote without metric artifacts and stable p95 runtime history."
    },
    {
      "id": "terminal-performance.daemon-ndjson-wire-parity-and-serialization",
      "title": "Daemon NDJSON preserves literal wire framing, Unicode and sequence spans",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-performance",
      "layer": "daemon-provider-contract",
      "surfaces": ["daemon stream", "NDJSON framing", "stream data batching"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic writer, batcher, droppability and NDJSON suites run locally on macOS with mocked socket/process boundaries. An SSH-shaped session ID is a string fixture, not SSH transport evidence. No live daemon, platform integration or mixed-version client/host pair is exercised; folder and git workspaces are not distinguished by these stream contracts. Audit1371 removes encode-count budgets, production-derived self-oracles and the copied previous writer. The independent literal JSON wire fixture and decoded Unicode/sequence framing invariants remain unchanged. Exact old-algorithm chunk-boundary equivalence and serialization-count alarms are intentionally lost; no throughput, latency or security equivalence is claimed. The complete prior mixed receipt is historical; fresh validation remains required. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed.",
      "motivatingLinks": ["src/main/daemon/daemon-stream-data-split.ts"],
      "invariant": "The retained literal JSON fixture fixes escaping and newline framing independently. Ordinary split frames at the tested viable cap preserve Unicode code points and sequence spans while fitting the cap.",
      "oracle": "Compare emitted lines to a literal JSON fixture; independently decode split lines, reconstruct the payload, reject split surrogate pairs, and inspect sequence/raw-length metadata. No previous-writer algorithm or encode-count oracle remains.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Target budget for the five deterministic suites; no current reduced-selector run or established p95. Prior timing remains only in the historical receipt."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "No fresh execution or sustained CI soak for the reduced selector is recorded."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "The removed serialization-count/previous-writer cases supply no current red/green evidence. The retained literal and decoded-wire callbacks require fresh validation."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Open gap after removing deterministic encode-count budgets. No current throughput, CPU, heap or input-latency measurement is claimed."
      },
      "promotionCriteria": [
        "Validate the retained literal and decoded-wire selector on the candidate SHA.",
        "Collect independent measured performance and sustained soak evidence before making performance claims; native/live transport and mixed-version coverage remain gaps."
      ],
      "knownGaps": [
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No live daemon/Electron, Linux, Windows, WSL, SSH, remote-runtime or mixed-version client/host evidence.",
        "The historical red run has not been independently reproduced for this registration; the parity oracle reuses current splitter/encoder helpers.",
        "No sustained soak, measured p95, wall-clock performance benchmark or native socket backpressure guarantee.",
        "Byte-cap assertions cover ordinary split frames at a viable cap; tiny caps and transformed frames retain legacy behavior rather than gaining a universal cap guarantee.",
        "Audit1371 removes encode-count budgets, production-derived self-oracles and the copied previous writer. The independent literal JSON wire fixture and decoded Unicode/sequence framing invariants remain unchanged. Exact old-algorithm chunk-boundary equivalence and serialization-count alarms are intentionally lost; no throughput, latency or security equivalence is claimed. The complete prior mixed receipt is historical; fresh validation remains required.",
        "Audit1372 historical assertion inventory, not current coverage: [{\"file\":\"src/main/daemon/daemon-stream-data-split.test.ts\",\"assertions\":[\"encodes an unsplit metadata-free frame once: %j\",\"reuses the encoded frame exactly at the inclusive byte cap\",\"does not add a duplicate full-data sizing probe to oversized writes\",\"keeps transformed writes at one encode without applying the ordinary byte cap\",\"preserves exact frames, chunk boundaries and metadata across payloads and caps\",\"keeps JSON escaping, Unicode and newline framing byte-for-byte\",\"keeps split frames within the byte cap and preserves code points and sequence spans\"]}]",
        "Historical receipt retired by audit1372 at 1f0e6b60b1cb31fc3aebaf573da5957297c8c613; original record unchanged, not current validation:\n{\n          \"date\": \"2026-09-11\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/daemon/daemon-stream-data-split.test.ts src/main/daemon/daemon-stream-data-batcher.test.ts src/main/daemon/daemon-stream-droppable-membership.test.ts src/main/daemon/daemon-stream-droppability-lifecycle.test.ts src/main/daemon/ndjson.test.ts\",\n          \"result\": \"passed\",\n          \"summary\": \"Five daemon suites passed: 70 tests total, including the new 12-test splitter suite. Vitest reported 14.76 seconds; no app or live transport validation was performed.\",\n          \"durationSeconds\": 14.76\n        }"
      ],
      "demotionRule": "Keep experimental; demote if literal framing, payload reconstruction, Unicode code-point boundaries or sequence metadata regress. Encode-count and old-writer chunk-boundary assertions were intentionally removed."
    },
    {
      "id": "terminal-performance.daemon-stream-backpressure",
      "title": "Daemon terminal streams respect socket backpressure under output floods",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-performance",
      "layer": "daemon-provider-contract",
      "surfaces": ["daemon stream", "socket write", "drain", "hidden output", "input starvation"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap on main. The daemon batcher write(false)/drain contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6836",
        "https://github.com/stablyai/orca/pull/6858"
      ],
      "invariant": "Daemon terminal output floods must pause when socket writes return false, resume on drain, keep buffered bytes bounded, and not starve focused input.",
      "oracle": "The current executable slice injects a slow socket and asserts write(false)/drain ordering, bounded queued daemon stream bytes, close/error listener cleanup, newest-tail preservation under sustained pressure, and flush-immediate cross-session priority ahead of unrelated background backlog on drain. Active input latency remains part of the broader perf gate.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "daemon provider-contract gate"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused daemon stream backpressure contract runs locally; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup and close/error clear pending drain listeners, and queued bytes are bounded by preserving priority output plus the newest tail. Needs intentional-break artifact plus active-input latency proof before promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Must record queued bytes, drain count, write(false) count, dropped output, and active input latency."
      },
      "promotionCriteria": [
        "Keep deterministic socket mocks as the blocking candidate only after soak.",
        "Record byte and drain artifacts on failure.",
        "Pair with the broader output-backpressure budget before blocking."
      ],
      "knownGaps": [
        "No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
        "Current command is daemon batcher contract coverage, not live daemon/Electron perf.",
        "Active input latency is not proven in live daemon/Electron perf."
      ],
      "demotionRule": "Cannot promote if backpressure is inferred only from renderer output success."
    },
    {
      "id": "terminal-performance.store-and-git-hot-paths",
      "title": "Terminal-adjacent store and git polling work stays off hot interaction paths",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-performance",
      "layer": "renderer-main-perf-contract",
      "surfaces": [
        "store selectors",
        "git polling",
        "startup hydration",
        "terminal focus",
        "tab switch",
        "workspace switch",
        "agent status"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap on main. The boot-hydration counters and their tests exist only on the pending reliability stack. It registers here with its owning split PR.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/7002"],
      "invariant": "Terminal typing, focus, resize, tab/workspace switch, and agent/session restore must not trigger unbounded store projection, git status, provider listing, or per-pane polling work.",
      "oracle": "The current executable slice instruments boot-time local PTY registry hydration with repo counts, local-vs-remote repo skips, worktree enumeration counts, adapter/session listing counts, registration/skipped-session counts, duration, and failure phase. The broader oracle still needs instrumentation that counts store selector recomputes, git status requests, provider listings, and session scans during scripted hot interactions with many worktrees and terminal panes.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "renderer-main perf/count gate"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Focused boot-hydration counter slice passed locally once; needs CI/runtime history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Tests would fail if boot hydration enumerated SSH worktrees, stopped recording provider-unavailable retry state, lost the startup counter surface, stopped recording fatal hydration failures, or missed router adapter fanout/list-failure counters. Needs intentional-break proof for git/status polling or store scans triggered by terminal hot paths."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Current slice records boot-hydration repo, worktree, adapter, session, skip, register, and duration counters. Promotion still requires count budgets for listSessions, git status, provider scans, store recomputes, and elapsed hot-interaction time."
      },
      "promotionCriteria": [
        "Use deterministic counters before broad perf scenarios.",
        "Cover high-session and high-worktree fixtures.",
        "Keep stress variants non-blocking until stable."
      ],
      "knownGaps": [
        "No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
        "Current command covers boot hydration counters only, not interactive terminal hot paths.",
        "No Electron count gate yet proves focus, typing, tab switch, workspace switch, render, or high-session provider fanout avoids broad store/git/provider scans."
      ],
      "demotionRule": "Cannot promote without count budgets and actionable artifacts."
    },
    {
      "id": "terminal-output.scrollback-restore",
      "title": "Scrollback restore, hidden output, and replay clear semantics do not overlap stale bytes",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-provider-contract",
      "surfaces": [
        "scrollback",
        "hidden output",
        "snapshot replay",
        "metadata-only replay",
        "clear semantics"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1391 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Local macOS evidence over the merged #7133/#7173 restore and hidden-output ordering tests on main@1282f5c2d. The dirty-state exactness contract, normal-buffer clear semantics, and metadata-only replay remain pending-stack work. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7173",
        "https://github.com/stablyai/orca/pull/7133",
        "https://github.com/stablyai/orca/pull/7012",
        "https://github.com/stablyai/orca/pull/7054",
        "https://github.com/stablyai/orca/pull/6949"
      ],
      "invariant": "Hidden-output restore, snapshot replay, metadata-only replay, and clear-before-replay must preserve order and never overlay stale bytes on newer live terminal output; restoring a snapshot onto an already-dirty pane must yield a buffer exactly equal to the snapshot frame.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1391 retired changed-source receipts. Historical oracle account: Apply snapshots onto adversarially dirty pane states (already on the alternate screen, stale content occupying cells the new frame leaves blank, scrollback present, wide glyphs, revived sessions with restarted PTY seq counters) and assert exact buffer equality with the snapshot frame; fault injection interleaves hidden chunks, live output, metadata-only replay, and clear-before-replay, then asserts ordered terminal buffer content, clear decisions, and replay diagnostics. Marker-presence checks are not acceptable evidence on restore paths.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 45,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1391 retired changed-source receipts; reduced selector has no new soak result. Historical account: Remote replay FIFO has a focused slice, but the broader scrollback restore gate is not wired."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1391 changed referenced test sources; no new red/green validation. Historical account: #7133 and #7173 each proved their slices red before fix (stale alt-screen bleed-through; stale background chunk written after restore; frozen revived seq counters). The broader dirty-state exactness contract has no red runs yet."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1391 changed test sources; no new measurement. Previous account: Must keep hidden restore bounded and avoid unbounded renderer parsing or wake loops."
      },
      "promotionCriteria": [
        "Start every restore case from adversarially dirty pane state, never only fresh terminals.",
        "Assert frame exactness or stale-content absence, never marker presence.",
        "Build deterministic lower-layer clear and interleaving tests before broad golden E2E.",
        "Use long-table/golden visual tests only as supporting evidence.",
        "Record ordered buffer diagnostics on failure."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "The existing replay FIFO command is narrower than this broader scrollback restore invariant.",
        "#7133's merged alt-only-clear restore tests exist on main but are not yet registered as this gate's command.",
        "#7173's ordered-seq interleaving and session-revival tests in pty-connection.test.ts on main are the seed for the hidden/live interleaving slice and are unregistered until the rebase.",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed.",
        "Audit1391 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.4,\n          \"summary\": \"1 test file(s) passed, 311 tests passed on main@1282f5c2d in a clean checkout.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\"\n        }",
        "Audit1391 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1391 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts\",\n    \"assertions\": [\n      \"recovers small live output when the deadline interrupts an answered snapshot\",\n      \"recovers partially covered live output when the deadline interrupts an answered snapshot\",\n      \"recovers split escape live output when the deadline interrupts an answered snapshot\",\n      \"recovers styled live output when the deadline interrupts an answered snapshot\",\n      \"recovers styled gap live output when the deadline interrupts an answered snapshot\",\n      \"recovers unmapped live output when the deadline interrupts an answered snapshot\",\n      \"recovers unhide gap live output when the deadline interrupts an answered snapshot\",\n      \"recovers fresh snapshot gap live output when the deadline interrupts an answered snapshot\",\n      \"recovers overflowed live output when the deadline interrupts an answered snapshot\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-replay.test.ts\",\n    \"assertions\": [\n      \"repaints a pushed image exactly, normal buffer included\",\n      \"replaces both buffers when the host screen has another grid\",\n      \"keeps history unduplicated when a pushed image also carries history\",\n      \"paints the whole image when the TUI started while hidden\",\n      \"reads the pane buffer after a queued alt-screen entry parses\",\n      \"repaints from the normal buffer once the host TUI has exited\",\n      \"clears a raw byte replay in place on the alt screen\",\n      \"paints a requested image from an exited TUI exactly over an alt screen\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-host-chain.test.ts\",\n    \"assertions\": [\n      \"keeps the covered history for a live TUI exactly as the host holds it\",\n      \"repaints from the normal buffer once the host TUI has exited\",\n      \"replaces the normal history that changed between two alt-screen sessions\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts\",\n    \"assertions\": [\n      \"restoring an alternate-screen snapshot clears only the alternate screen (#7133)\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n    \"assertions\": [\n      \"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n    \"assertions\": [\n      \"pending hidden restore chunks are not replayed after a terminal clear\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\",\n    \"assertions\": [\n      \"a scrolled-up viewport is preserved after hidden-backlog snapshot replay\"\n    ]\n  }\n]",
        "Audit1391 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts\",\n          \"assertions\": [\n            \"recovers small live output when the deadline interrupts an answered snapshot\",\n            \"recovers partially covered live output when the deadline interrupts an answered snapshot\",\n            \"recovers split escape live output when the deadline interrupts an answered snapshot\",\n            \"recovers styled live output when the deadline interrupts an answered snapshot\",\n            \"recovers styled gap live output when the deadline interrupts an answered snapshot\",\n            \"recovers unmapped live output when the deadline interrupts an answered snapshot\",\n            \"recovers unhide gap live output when the deadline interrupts an answered snapshot\",\n            \"recovers fresh snapshot gap live output when the deadline interrupts an answered snapshot\",\n            \"recovers overflowed live output when the deadline interrupts an answered snapshot\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-replay.test.ts\",\n          \"assertions\": [\n            \"repaints a pushed image exactly, normal buffer included\",\n            \"replaces both buffers when the host screen has another grid\",\n            \"keeps history unduplicated when a pushed image also carries history\",\n            \"paints the whole image when the TUI started while hidden\",\n            \"reads the pane buffer after a queued alt-screen entry parses\",\n            \"repaints from the normal buffer once the host TUI has exited\",\n            \"clears a raw byte replay in place on the alt screen\",\n            \"paints a requested image from an exited TUI exactly over an alt screen\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-host-chain.test.ts\",\n          \"assertions\": [\n            \"keeps the covered history for a live TUI exactly as the host holds it\",\n            \"repaints from the normal buffer once the host TUI has exited\",\n            \"replaces the normal history that changed between two alt-screen sessions\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts\",\n          \"assertions\": [\n            \"restoring an alternate-screen snapshot clears only the alternate screen (#7133)\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\"pending hidden restore chunks are not replayed after a terminal clear\"]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\",\n          \"assertions\": [\"a scrolled-up viewport is preserved after hidden-backlog snapshot replay\"]\n        }\n      ]",
        "Audit1391 archived active selectors after retirement of all passed receipts: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\",\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts --maxWorkers=1\",\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-replay.test.ts src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-host-chain.test.ts\"],\"testFiles\":[\"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts\",\"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-replay.test.ts\",\"src/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-host-chain.test.ts\"]}"
      ],
      "demotionRule": "Cannot promote without clear-semantics and hidden/live interleaving assertions."
    },
    {
      "id": "terminal-capability.startup-color-query",
      "title": "Startup color capability queries do not leak into shell or terminal streams",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-provider-contract",
      "surfaces": [
        "OSC 10/11",
        "startup capability query",
        "shell stream",
        "renderer stream",
        "terminal colors"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; no executable coverage is wired yet.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/6949"],
      "invariant": "Startup OSC 10/11 color queries are answered out of band at startup only, never leak into shell/provider output streams, and ordinary runtime OSC color queries remain renderer-handled.",
      "oracle": "A provider-contract fixture records startup query replies, shell-visible bytes, renderer-visible bytes, and later runtime OSC behavior to prove no query leakage or color deadlock.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "renderer provider-contract gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Gate is registered as a capability/startup gap; no command is wired."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs intentional-break proof for leaked startup OSC replies or disabled runtime OSC handling."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Required if capability probing adds retry loops or startup polling."
      },
      "promotionCriteria": [
        "Assert shell/provider byte streams directly.",
        "Cover startup-only and runtime OSC paths separately.",
        "Keep screenshot evidence diagnostic only."
      ],
      "knownGaps": ["No manifest command yet.", "No startup color-query contract is wired."],
      "demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
    },
    {
      "id": "terminal-input.cooked-reply-queue",
      "title": "Terminal query replies stay atomic and bounded without evicting ordinary input",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "renderer-provider-contract",
      "surfaces": [
        "desktop terminal input",
        "OSC 10/11 replies",
        "mode-2031 replies",
        "DA1 and CPR replies",
        "local PTY",
        "daemon and SSH PTYs"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "Audit3362 retires the 10,000-query newest64 viewport-claim flood-cap assertion and second-chunk refusal, coalescing/burst/limit/yield and constant examples. The surviving ordinary/query/ordinary binary-frame ordering and UTF8 emoji-safe acknowledged chunk cases retain narrower coverage. Unit commands/test-file selectors remain; the first binary-order assertion stays exact. Two unrelated macOS E2E receipts remain verbatim with their original scope. No equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit 3312 reduces remote-runtime-pty-batching.test.ts, intentionally losing idle leading/trailing coalescing, leading-edge-disabled, accumulated byte-ceiling flush, standalone synchronous oversized-input rejection, accepted-input validation yield, deferred pending-tail byte order, and queued-viewport clear/flush and timer-cancellation alarms. The unchanged UTF-8 splitting, validation barrier ordering and asynchronous oversized-input nondelivery cases are narrower, not equivalent replacements. The barrier assertion and both existing Electron receipts remain unchanged and do not validate these retired cases. No fresh runtime, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3292 retires the empty-queue immediate query-reply delivery example from remote-runtime-pty-query-reply-immediate.test.ts. Pending ordinary-input separation and asynchronous paste-validation ordering cases remain byte-identical, matching the existing assertion reference. The no-pending-input delivery alarm is intentionally lost without equivalent replacement. Existing selectors, unchanged local Electron receipts and historical receipts remain exact; no new runtime, PTY deadline, platform or mixed-version result is claimed. Audit3086: retire the immediate-reply ceiling and thrown renderer-write recovery aliases. Narrow FIFO coverage to deferred preconnect validation and teardown coverage to natural-exit stale ordinary/accepted tails; live acknowledged barriers and disconnect/detach branches are intentionally retired. Prior queue cleanup and unchanged Electron receipts remain exact; no replacement or fresh execution is claimed. Audit1878 retires the dated reduced-source unit receipt. Only the unchanged macOS local Electron receipts remain current, scoped to their exact commands; reduced unit selectors and SSH have no current execution receipt. Historical pre-audit coverageNotes: Deterministic renderer and IPC-transport tests prove count and text ceilings, oldest-reply shedding, explicit query-reply source routing, ordinary-input preservation, acknowledged-write FIFO barriers, single-worker drain reentrancy, one-reply-per-write delivery for OSC, DA1, and CPR replies, real xterm OSC reply generation, drain-failure containment, teardown settlement, and clear/reuse generation fencing. Remote-runtime tests preserve separate query-reply writes across pending input, async validation, and viewport-claim buffering. Host-contract tests prove a later DA1/CPR reply cannot overtake a deferred OSC reply, including a coalesced legacy-client payload. Live macOS Electron tests cover local PTY OSC replies and interactive typing; a macOS-hosted Docker OpenSSH test proves an upstream-node-pty Linux relay keeps OSC/DA1 replies out of the next fish child's stdin. No live daemon, paired-runtime, WSL, physical Linux/Windows client, or binary mixed-version run is registered.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/13137",
        "https://github.com/stablyai/orca/issues/7329",
        "https://github.com/stablyai/orca/issues/13892"
      ],
      "invariant": "The desktop PTY input queue retains at most 64 explicitly sourced pending terminal query replies and 4096 UTF-16 code units. Every retained reply reaches the provider as one atomic write, and ordinary, acknowledged, and reply input share one invocation-ordered FIFO so no later write overtakes an acknowledged write. Reentrant write callbacks cannot start a second drain worker or strand input admitted after clear/reuse. A reply's own echo is contained on the output side by projecting its known echo shapes; the ESC-initial verbatim shape is matched only when complete, never held as a partial, so a query torn at its own ESC is still answered. Overflow removes only the oldest query replies, never ordinary input except the documented modified-F3/CPR byte collision, and failure or teardown cannot clear a newer queue generation or strand an acknowledged promise.",
      "oracle": "Audit3362 retires the 10,000-query newest64 viewport-claim flood-cap assertion and second-chunk refusal, coalescing/burst/limit/yield and constant examples. The surviving ordinary/query/ordinary binary-frame ordering and UTF8 emoji-safe acknowledged chunk cases retain narrower coverage. Unit commands/test-file selectors remain; the first binary-order assertion stays exact. Two unrelated macOS E2E receipts remain verbatim with their original scope. No equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit 3312 reduces remote-runtime-pty-batching.test.ts, intentionally losing idle leading/trailing coalescing, leading-edge-disabled, accumulated byte-ceiling flush, standalone synchronous oversized-input rejection, accepted-input validation yield, deferred pending-tail byte order, and queued-viewport clear/flush and timer-cancellation alarms. The unchanged UTF-8 splitting, validation barrier ordering and asynchronous oversized-input nondelivery cases are narrower, not equivalent replacements. The barrier assertion and both existing Electron receipts remain unchanged and do not validate these retired cases. No fresh runtime, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3292 retires the empty-queue immediate query-reply delivery example from remote-runtime-pty-query-reply-immediate.test.ts. Pending ordinary-input separation and asynchronous paste-validation ordering cases remain byte-identical, matching the existing assertion reference. The no-pending-input delivery alarm is intentionally lost without equivalent replacement. Existing selectors, unchanged local Electron receipts and historical receipts remain exact; no new runtime, PTY deadline, platform or mixed-version result is claimed. Audit3086: retire the immediate-reply ceiling and thrown renderer-write recovery aliases. Narrow FIFO coverage to deferred preconnect validation and teardown coverage to natural-exit stale ordinary/accepted tails; live acknowledged barriers and disconnect/detach branches are intentionally retired. Prior queue cleanup and unchanged Electron receipts remain exact; no replacement or fresh execution is claimed. Audit1878 retires the dated reduced-source unit receipt. Only the unchanged macOS local Electron receipts remain current, scoped to their exact commands; reduced unit selectors and SSH have no current execution receipt. Historical pre-audit oracle: Synchronously enqueue separate 10,000-entry OSC and DA1 reply floods before the scheduled drain and assert that only the initial immediate reply and newest 64 pending replies are written, each as one provider write, before a trailing keystroke. Stall an acknowledged write between earlier and later ordinary/reply input, then require teardown to settle it and same-id reuse to receive no stale tail. Reenter the queue synchronously from an acknowledged write with both enqueue and clear/reuse, requiring one drain and fresh input delivery only after the stale acknowledged write settles false. At the host boundary, defer an OSC reply and assert that separate or legacy-coalesced DA1/CPR replies flush after it in observed query order. At the remote-runtime boundary, preserve separate writes around pending ordinary input, async validation, and viewport-claim buffering. Repeat behind 10,000 ordinary inputs and exercise the text ceiling, real xterm generation, provider-write failure, rejected yield, and clear/reuse generation fencing.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/input/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts src/shared/terminal/protocol/queries/terminal-query-reply.test.ts src/shared/terminal/pty/ingress/pty-startup-ingress-live-query-reply.test.ts src/shared/terminal/pty/ingress/pty-startup-reply-echo-shapes.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/output/remote-runtime-pty-batching.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-query-reply-immediate.test.ts src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-input-coalescing.test.ts",
        "pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/terminal-pane/pty-transport/input/pty-input-write-queue.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/output/remote-runtime-pty-batching.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-query-reply-immediate.test.ts",
        "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-input-coalescing.test.ts",
        "src/shared/terminal/protocol/queries/terminal-query-reply.test.ts",
        "src/shared/terminal/pty/ingress/pty-startup-ingress-live-query-reply.test.ts",
        "src/shared/terminal/pty/ingress/pty-startup-reply-echo-shapes.test.ts",
        "tests/e2e/terminal-osc-color-queries.spec.ts",
        "tests/e2e/terminal-typing-latency.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/input/pty-input-write-queue.test.ts",
          "assertions": [
            "provider-write and yield failures settle without unhandled rejection, repeated same-generation admission, or stale-generation clearing",
            "clear fences in-flight validation before later input",
            "acknowledged input is serialized between earlier and later ordinary/reply writes",
            "clear settles active and pending acknowledged input before same-id queue reuse",
            "reentrant enqueue cannot start a second drain worker past an unacknowledged write",
            "reentrant clear captures the stale cancellation and continues draining fresh input"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts",
          "assertions": [
            "deferred preconnect validation preserves queued bytes before later accepted, ordinary, and immediate input",
            "natural exit settles active acknowledged input and fences ordinary and accepted stale chunks before same-id reuse"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/output/remote-runtime-pty-batching.test.ts",
          "assertions": [
            "a validation barrier runs after earlier deferred input and before later input"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-query-reply-immediate.test.ts",
          "assertions": [
            "pending ordinary input and asynchronously validated paste stay ahead of but separate from an immediate query reply"
          ]
        },
        {
          "file": "src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-input-coalescing.test.ts",
          "assertions": [
            "viewport-claim buffering replays ordinary input, a query reply, and later ordinary input as three ordered stream frames"
          ]
        },
        {
          "file": "src/shared/terminal/protocol/queries/terminal-query-reply.test.ts",
          "assertions": [
            "only complete query replies are classified and consecutive mixed reply kinds extract losslessly"
          ]
        },
        {
          "file": "src/shared/terminal/pty/ingress/pty-startup-ingress-live-query-reply.test.ts",
          "assertions": [
            "repeated live query replies are delivered independently and their cooked echoes stay hidden"
          ]
        },
        {
          "file": "tests/e2e/terminal-osc-color-queries.spec.ts",
          "assertions": [
            "real Electron xterm OSC 10/11 replies reach the active local PTY as separate writes"
          ]
        },
        {
          "file": "tests/e2e/terminal-typing-latency.spec.ts",
          "assertions": [
            "real keyboard input reaches and echoes from the active local PTY within the interactive latency ceilings"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-09",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 13.2,
          "summary": "The real Electron/xterm OSC 10/11 query path wrote the exact foreground and background replies separately to the active local PTY."
        },
        {
          "date": "2026-08-09",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 10.6,
          "summary": "Real keyboard events traversed xterm and the input queue to a local interactive PTY with every sampled key echoed inside the latency ceiling."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "Historical pre-audit combined-selector budget; reduced unit selectors have no new runtime measurement. Unchanged local Electron receipts retain their exact durations."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Reduced unit selectors have no new soak result after Audit1878; unchanged local Electron receipts apply only to their original commands. Historical account: Ten consecutive local unit-gate runs passed 1,380 tests in 29.57 seconds total with no fixed timing sleeps. The exact Docker SSH OSC oracle passed three consecutive runs before extraction and then passed both registered full-spec runs. The upstream-node-pty fish handoff oracle passed three local runs, including the final post-rebase run. CI and the normal soak window are not yet available."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Without the branch's admission cap, the 10,000-reply fixture writes all replies before the trailing keystroke. Before the source-routing repair, the queue had no API capable of distinguishing reply-shaped ordinary input; before failure containment, a thrown provider write rejected waitForDrain and Vitest recorded an unhandled rejection; the first containment pass retried a failed generation and invoked recovery twice; before generation fencing, a rejected stale yield cleared fresh input. Before reentrancy fencing, a synchronous accepted-write callback started a second drain that falsely accepted the pending write; clear/reuse also captured the replacement generation's cancellation and stranded fresh input. No saved intentional-break artifact is attached yet."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Pending query replies are capped at 64 and 4096 UTF-16 code units. Explicit source routing and separate sequence-merged FIFOs keep ordinary input out of the fixed-size reply store; oldest-reply eviction uses an amortized O(1) head advance without scanning ordinary input, consumed prefixes compact at a fixed threshold, and drain coalescing reads the stored classification without repeated reply-regex scans. Separate synchronous OSC and DA1 floods forward only the immediate first and newest 64 replies before the trailing key, and the remote-runtime viewport-claim buffer likewise retains only the newest 64 query segments while coalescing adjacent ordinary input. The sync ECHO probe removes an `stty` subprocess from the common quiet-query path and the fallback adds no polling beyond the existing bounded ECHO probe."
      },
      "promotionCriteria": [
        "Run the gate on Windows and Linux CI.",
        "Exercise a live daemon PTY with cooked echo enabled and record exact shell-visible and provider-visible bytes.",
        "Attach an intentional-break run proving reply overflow cannot evict ordinary input or exceed either ceiling.",
        "Accumulate the normal soak window with zero unexplained flakes."
      ],
      "knownGaps": [
        "Audit3077 deletes the delivery-watchdog suite and retires queue flood, conservation, atomicity, retention, echo and heap examples plus preconnect cap/seed/abandon examples. The remaining queue failure/FIFO/reentrancy/generation and preconnect lifetime cases are narrower; no equivalent replacement is claimed.",
        "No live daemon, paired-runtime, WSL, physical Linux/Windows client, mixed-version, or network-fault run is registered.",
        "Ordinary-input queue growth predates this change and is outside this reply-only gate.",
        "Reply overload intentionally sheds the oldest synthetic replies; the modified-F3/CPR byte collision shares that budget, and live application behavior under a pathological query flood is not measured.",
        "Audit1878 retires this complete dated receipt because a source in its selector was reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/shared/terminal-query-reply.test.ts src/shared/pty-startup-ingress-live-query-reply.test.ts src/shared/pty-startup-reply-echo-shapes.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport/input/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-input-write.test.ts src/shared/terminal/protocol/queries/terminal-query-reply.test.ts src/shared/terminal/pty/ingress/pty-startup-ingress-live-query-reply.test.ts src/shared/terminal/pty/ingress/pty-startup-reply-echo-shapes.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 15,\n          \"summary\": \"Five files and 149 tests passed in 15.16 seconds, including explicit IPC reply-source routing, the 10,000-reply count and text ceilings, 10,000-entry ordinary backlog preservation, acknowledged-write FIFO barriers, synchronous reentrancy fencing, prompt teardown settlement, same-id generation fencing, real xterm OSC query floods, single-shot drain-failure recovery, and one-reply-per-write echo containment.\"\n        }",
        "Audit1878 removes standalone reply-classifier inventory, ordinary-keystroke helper/no-write checks and a latency-order title that never executes the host path from pty-startup-ingress-live-query-reply.test.ts. It also removes projection needle/refusal/holdPartial and ConPTY/WSL string/array inventories from pty-startup-reply-echo-shapes.test.ts, including the direct short-needle and ESC-hold guard alarms. Captured echo matching and actual ingress writes/output state remain, without equivalent replacement coverage. Only the two unchanged macOS local Electron receipts remain active; neither proves the reduced five-file unit selector, SSH, a new soak result, or a new measured budget.",
        "Audit3086: retire the immediate-reply ceiling and thrown renderer-write recovery aliases. Narrow FIFO coverage to deferred preconnect validation and teardown coverage to natural-exit stale ordinary/accepted tails; live acknowledged barriers and disconnect/detach branches are intentionally retired. Prior queue cleanup and unchanged Electron receipts remain exact; no replacement or fresh execution is claimed.",
        "Audit 3292 retires the empty-queue immediate query-reply delivery example from remote-runtime-pty-query-reply-immediate.test.ts. Pending ordinary-input separation and asynchronous paste-validation ordering cases remain byte-identical, matching the existing assertion reference. The no-pending-input delivery alarm is intentionally lost without equivalent replacement. Existing selectors, unchanged local Electron receipts and historical receipts remain exact; no new runtime, PTY deadline, platform or mixed-version result is claimed.",
        "Audit 3312 reduces remote-runtime-pty-batching.test.ts, intentionally losing idle leading/trailing coalescing, leading-edge-disabled, accumulated byte-ceiling flush, standalone synchronous oversized-input rejection, accepted-input validation yield, deferred pending-tail byte order, and queued-viewport clear/flush and timer-cancellation alarms. The unchanged UTF-8 splitting, validation barrier ordering and asynchronous oversized-input nondelivery cases are narrower, not equivalent replacements. The barrier assertion and both existing Electron receipts remain unchanged and do not validate these retired cases. No fresh runtime, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3362 retires the 10,000-query newest64 viewport-claim flood-cap assertion and second-chunk refusal, coalescing/burst/limit/yield and constant examples. The surviving ordinary/query/ordinary binary-frame ordering and UTF8 emoji-safe acknowledged chunk cases retain narrower coverage. Unit commands/test-file selectors remain; the first binary-order assertion stays exact. Two unrelated macOS E2E receipts remain verbatim with their original scope. No equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3362 historical original assertionRefs object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-input-coalescing.test.ts\",\n          \"assertions\": [\n            \"viewport-claim buffering replays ordinary input, a query reply, and later ordinary input as three ordered stream frames\",\n            \"a 10,000-reply viewport-claim flood retains and replays only the newest 64 query replies\"\n          ]\n        }"
      ],
      "demotionRule": "Keep experimental or revert if ordinary input is evicted, pending replies exceed either ceiling, retained replies are coalesced, a trailing key sits behind more than the bounded reply window, or the gate develops unexplained flakes."
    },
    {
      "id": "terminal-query.mobile-view-authority",
      "title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "mobile-runtime-rpc-contract",
      "surfaces": [
        "mobile terminal WebView",
        "terminal query authority",
        "runtime RPC",
        "mobile subscription replay",
        "multi-mobile input floor"
      ],
      "platforms": ["macos", "linux", "windows", "mobile"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/terminal/mobile-terminal-query-reply.test.ts. Historical scope: Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove elected-subscriber, no-floor-taking and query/enter/interrupt/guarded-send validation aliases from terminal-send because those callbacks are removed. Keep the existing pre-fit listener/query-buffering aliases only at the retained supplied-runtime subscribe callback. Its subscription-registry double and injected fit/data producers do not prove actual mobile view election or live terminal delivery. Preserve the independent mobile bridge receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Deterministic local tests execute the exact injected mobile replay/generation gate, the React Native query classifier, stale-subscription sender, server-side single-responder election, query-reply RPC semantics, and live-output capture during async mobile fit. The provider write path is shared, but no live iOS/Android, SSH, WSL, or multi-device run is registered yet.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/8128",
        "https://github.com/stablyai/orca/pull/8206"
      ],
      "invariant": "Snapshot and replacement-terminal replay answer no terminal queries; every live query delivered to subscribed mobile views has at most one current responder; a live query queued behind replay is answered after the replay boundary; terminal-generated replies never transfer the user-input floor.",
      "oracle": "Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Historical oracle: Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove elected-subscriber, no-floor-taking and query/enter/interrupt/guarded-send validation aliases from terminal-send because those callbacks are removed. Keep the existing pre-fit listener/query-buffering aliases only at the retained supplied-runtime subscribe callback. Its subscription-registry double and injected fit/data producers do not prove actual mobile view election or live terminal delivery. Preserve the independent mobile bridge receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The injected gate emits zero replies during replay, exactly one after its live boundary, and ignores a superseded generation; native routing rejects ordinary input; the sender rejects disconnected or unsubscribed handles; runtime election accepts only the earliest active mobile subscriber and promotes its survivor; terminal.send writes only validated query grammar without mobileTookFloor; legacy binary subscribe captures a query while phone-fit is still pending and emits it after the snapshot.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured. Prior scope: Audit1931: The affected dated receipt is retired whole into historical notes. Pre-audit observations do not validate the reduced-source bytes. No promotion, equivalent replacement, fresh red/green, soak or runtime measurement is claimed. Historical prior account (preserved verbatim): mobile and runtime deterministic unit gate"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "No fresh soak validates the reduced sources. Historical account: {\"status\":\"unknown\",\"evidence\":\"Audit1931: The affected dated receipt is retired whole into historical notes. Pre-audit observations do not validate the reduced-source bytes. No promotion, equivalent replacement, fresh red/green, soak or runtime measurement is claimed. Historical prior account (preserved verbatim): New deterministic gate; no soak history yet. Tests use no timing sleeps or external services.\"}"
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "No fresh red/green validates the reduced sources. Historical account: {\"status\":\"missing\",\"evidence\":\"Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1991: Remove elected-subscriber, no-floor-taking and query/enter/interrupt/guarded-send validation aliases from terminal-send because those callbacks are removed. Keep the existing pre-fit listener/query-buffering aliases only at the retained supplied-runtime subscribe callback. Its subscription-registry double and injected fit/data producers do not prove actual mobile view election or live terminal delivery. Preserve the independent mobile bridge receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931: The affected dated receipt is retired whole into historical notes. Pre-audit observations do not validate the reduced-source bytes. No promotion, equivalent replacement, fresh red/green, soak or runtime measurement is claimed. Historical prior account (preserved verbatim): Observed red before implementation for the missing WebView listener/native route/sender and for RPC floor-taking plus unvalidated claims; all are green after the fix. The later multi-mobile and pre-fit race assertions have green deterministic coverage but no saved intentional-break artifact yet.\"}"
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh reduced-source performance measurement is claimed. Historical account: Audit1991: Remove elected-subscriber, no-floor-taking and query/enter/interrupt/guarded-send validation aliases from terminal-send because those callbacks are removed. Keep the existing pre-fit listener/query-buffering aliases only at the retained supplied-runtime subscribe callback. Its subscription-registry double and injected fit/data producers do not prove actual mobile view election or live terminal delivery. Preserve the independent mobile bridge receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): No polling, scans, timers, or output fanout were added. The WebView adds one disposable onData listener; native/RPC work occurs only for xterm data and is grammar-filtered; responder election is O(1) from Map insertion order; pre-fit output uses the existing capped pending-output queue."
      },
      "promotionCriteria": [
        "Attach an intentional-break artifact for the pre-fit capture and multi-mobile election assertions.",
        "Run live iOS and Android WebViews against a real querying TUI and verify no software-keyboard regression.",
        "Exercise two physical/virtual mobile clients on one PTY and observe one reply per query.",
        "Accumulate the normal soak window with zero unexplained flakes."
      ],
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "No live iOS or Android WebView run is registered.",
        "No real SSH, WSL, daemon, or two-device provider-contract run is registered.",
        "Mixed-version pairing is gated by the terminal.query-reply-input.v1 capability (mobile drops replies unless the host advertises it), but no live old-binary pairing run is registered.",
        "A desktop-to-mobile driver handoff has a bounded double-reply window: the server elects the mobile responder synchronously while the desktop renderer's cached driver map updates via an async event, so an in-flight query can be answered by both until the driver-change event lands.",
        "Retired during audit1345 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-10\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts\",\"result\":\"passed\",\"durationSeconds\":11,\"summary\":\"421 renderer terminal connection tests passed, including desktop onData and capability-handler suppression while mobile owns query authority.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-input-and-repaint.test.ts\"}",
        "Audit1931 (sources1928/1929): Partial mobile-presence suite retains only five authored callbacks: admitted preview-paste completion across phone takeover, desktop take-back superseding mobile input, desktop viewport write/restore geometry, and held-fit reclaim convergence. Other supplied floor/rollback/selection/viewport/grace/disconnect/reconnect/orphan-state alarms are lost. No per-source assertion object exists to reassign. The one affected dated mobile-view-authority receipt is retired whole into historical notes with its full original/currentCommand/raw data preserved; it is not active corroboration for reduced candidate bytes. Imported mobile-subscribe registrations and retained callbacks remain bounded to their actual source obligations, without equivalent replacement or physical-phone/native-PTY claims. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'starts idle for unknown PTY'; 'handleMobileSubscribe in auto mode transitions idle → mobile{clientId}'; 'handleMobileSubscribe in desktop mode is passive — does NOT take floor'; 'reclaimTerminalForDesktop transitions mobile → desktop and is idempotent'; 'mobileTookFloor after reclaim re-applies phone-fit and flips driver back to mobile'; 'restores the pre-write driver after overlapping claims from one phone both fail'; 'keeps a successful overlapping claim as the rollback baseline'; 'does not let an older phone-fit completion retake a newer writer floor'; 'a superseded mobile input %s preserves a newer phone claim'; 'mobile input without an active subscriber cannot create an orphaned floor lock'; 'a %s phone-fit completion after disconnect cannot recreate the mobile lock'; 'admits a soft-leaving client to reserve the input floor within the grace window'; 'handleMobileUnsubscribe last leaver flips driver to idle after soft-leave grace'; 'resubscribe within soft-leave grace cancels idle without driver flap'; 'onPtyExit clears driver state and emits idle'; 'elects one query responder and promotes the survivor on unsubscribe'; 'keeps the earliest subscriber authoritative after a soft-leave resubscribe'; 'excludes an older passive desktop-mode subscriber from reply authority'; 'most-recent actor wins active phone-fit dims (B subscribes after A)'; 'B unsubscribes — A still present, driver re-elects to A'; 'A then B unsubscribes — peer survives; final unsubscribe goes idle'; 'terminal.send by phone-B updates lastActedAt — applyMobileDisplayMode picks B viewport'; 'mobile mode change marks the caller before applying phone-fit'; 'updateMobileViewport re-fits PTY without flipping the driver'; 'updateMobileViewport late-binds a viewport-less mobile subscriber'; 'updateMobileViewport records viewport without applying layout in desktop mode'; 'updateMobileViewport reports applied=false when phone-fit resize fails'; 'updateMobileViewport then disconnect restores PTY to original baseline'; 'legacy unsubscribe → resubscribe within grace preserves baseline (regression)'; 'earliest-subscribe restore target is preserved when peers churn'; 'second Restore click after success returns true with no new resize or fit-override event'; 'driving take-back still converges: driver → desktop, override cleared, both channels notified'; 'held restore with a failing resize still releases and clears the override'; 'active-subscriber take-back with a failing resize still releases the lock'; 'phone-initiated setDisplayMode(desktop) against a stale held override converges'; 'orphan cleanup: reclaim on a held override with no layout entry converges'; 'a still-subscribed phone reporting its viewport does not undo a desktop take-back'; 'a deliberate mobile gesture still re-takes the floor after a desktop take-back'; 'a replayed subscribe after a reconnect does not undo a desktop take-back'; 'a foreground resubscribe inside the soft-leave grace does not undo a desktop take-back'; 'typing on the phone after a reconnect re-takes the floor and phone-fits again'; 'take-back of a held phone-fit with no subscriber also keeps the next subscribe passive'.",
        "Audit1931 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-07-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal/protocol/queries/terminal-query-reply.test.ts src/shared/terminal/protocol/queries/terminal-reply-query-scan.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 4,\n          \"summary\": \"69 shared/runtime tests passed. Before implementation, terminal.send took the floor for claimed replies and accepted ordinary claimed bytes.\"\n        }",
        "Audit1991: Remove elected-subscriber, no-floor-taking and query/enter/interrupt/guarded-send validation aliases from terminal-send because those callbacks are removed. Keep the existing pre-fit listener/query-buffering aliases only at the retained supplied-runtime subscribe callback. Its subscription-registry double and injected fit/data producers do not prove actual mobile view election or live terminal delivery. Preserve the independent mobile bridge receipt. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/terminal-send.test.ts\",\n          \"assertions\": [\n            \"only the elected mobile subscriber can write a claimed query reply\",\n            \"valid replies skip mobileTookFloor\",\n            \"ordinary bytes and reply payloads combined with enter, interrupt, or guarded-send semantics are rejected\"\n          ]\n        }",
        "Mobile owner-layout policy retires whole tests and mixed registrations without equivalent replacement coverage. Retained callbacks and reduced selectors need fresh execution at their stated scope; prior measurements do not validate them. Affected sources: mobile/src/terminal/mobile-terminal-query-reply.test.ts.",
        "Historical active selectors retired because no unaffected passed receipt remains: {\"commands\":[\"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/terminal/layout/mobile-presence-lock.test.ts src/shared/terminal/protocol/queries/terminal-query-reply.test.ts src/shared/terminal/protocol/queries/terminal-reply-query-scan.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\"],\"testFiles\":[\"mobile/src/terminal/terminal-webview-query-reply.test.ts\",\"mobile/src/terminal/terminal-webview-query-reply-routing.test.ts\",\"mobile/src/terminal/mobile-terminal-query-reply.test.ts\",\"src/main/runtime/rpc/terminal-send.test.ts\",\"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\"src/main/runtime/terminal/layout/mobile-presence-lock.test.ts\",\"src/shared/terminal/protocol/queries/terminal-query-reply.test.ts\",\"src/shared/terminal/protocol/queries/terminal-reply-query-scan.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\"],\"assertionRefs\":[{\"file\":\"mobile/src/terminal/terminal-webview-query-reply.test.ts\",\"assertions\":[\"snapshot replay emits no terminal-data message before the replay boundary\",\"a live query after the boundary emits exactly one terminal-data message\",\"a superseded terminal generation cannot regain reply authority\",\"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert\"]},{\"file\":\"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\"assertions\":[\"live terminal data and view authority register before asynchronous mobile fit\",\"a query received during that await is retained and emitted after the snapshot\"]},{\"file\":\"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\"assertions\":[\"desktop xterm onData replies are dropped while mobile owns the terminal driver\",\"desktop capability-handler replies outside onData honor the same mobile authority lock\"]}]}",
        "Historical complete receipt retired because its selector includes changed sources; no validation transfers. Original receipt verbatim:\n{\n          \"date\": \"2026-07-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1,\n          \"summary\": \"10 mobile bridge, routing, replay/generation, and stale-subscription tests passed. Before implementation, the WebView listener, native route, and sender tests failed.\"\n        }",
        "Historical assertion references before mobile owner-layout policy; removed references have no replacement claim: [{\"file\":\"mobile/src/terminal/terminal-webview-query-reply.test.ts\",\"assertions\":[\"snapshot replay emits no terminal-data message before the replay boundary\",\"a live query after the boundary emits exactly one terminal-data message\",\"a superseded terminal generation cannot regain reply authority\",\"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert\"]},{\"file\":\"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\"assertions\":[\"live terminal data and view authority register before asynchronous mobile fit\",\"a query received during that await is retained and emitted after the snapshot\"]},{\"file\":\"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\"assertions\":[\"desktop xterm onData replies are dropped while mobile owns the terminal driver\",\"desktop capability-handler replies outside onData honor the same mobile authority lock\"]}]"
      ],
      "demotionRule": "Keep experimental or disable mobile forwarding if the gate flakes without a product bug, live WebView input isolation regresses, or duplicate replies appear under multi-mobile use."
    },
    {
      "id": "terminal-runtime.mobile-stream-budget",
      "title": "Runtime and mobile terminal streams keep snapshot and live-output bytes bounded",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "runtime-rpc-contract",
      "surfaces": [
        "mobile terminal",
        "native-chat terminal overlay",
        "runtime RPC",
        "binary multiplex",
        "JSON subscribe fallback",
        "snapshot buffering"
      ],
      "platforms": ["macos", "linux", "windows", "mobile"],
      "providers": ["remote-runtime", "ssh", "local", "daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Local macOS evidence covers runtime-RPC stream budgets, paired-renderer parse/discard credit, and negotiated host-side suppression for hidden paired desktop panes. Deferred credit is shared by local and remote transports, batches ACKs at 192 KiB or 4 ms, grows per-stream windows from 512 KiB to 2 MiB and aggregate windows from 2 MiB to 8 MiB, bounds queued output to 256 KiB per stream, and caps each multiplex connection at 32 active or pending streams for an 8 MiB aggregate pending-output ceiling. Deterministic tests cover replay ordering, stale generations, malformed frames, hidden panes, queue eviction, disposal, send/recovery failure, repeated pending-slot replacement, reconnect, mixed-version pause negotiation, and round-robin fairness. The opt-in benchmark models 1/20/100 ms RTT and 1/4/8 viewers, throughput, window use, completion spread and protocol-frame counts. It measures model scheduler elapsed time separately from actual @xterm/headless parser CPU/retained heap; modeled credit and ACK results do not qualify production credit enforcement. Live Android restore evidence, browser/WebGL parser measurements, and legacy JSON subscribe parity remain required. The audit removed the PTY ACK wrapper suite, which replayed credit arithmetic with mocked IPC. Its isolated wrapper alarms are no longer registered here; generic credit and runtime stream tests do not establish equivalent PTY integration coverage. The audit removes the standalone auto-settle-before-deferred-claim example. Nested-owner and claimed-child completion tests remain; they do not establish that removed timing alarm. The test-value audit removes the bulk-ACK threshold, output-pause capability/paused-input, transformed-metadata disposal, late-parser and renderer-throw examples. The retained captured-parser, malformed-frame and failed-ACK timer checks do not exercise real xterm parsing or server credit enforcement and do not replace the removed alarms. Historical run commands and results remain historical. The test-value audit removes the pure mobile stream-decision suite: pause/resume/rearm/viewport branch inventories no longer have that isolated alarm. The surviving stream-hook tests do not establish equivalent WebView restore, PTY resize, input-lease or subscription delivery coverage. Historical run commands and counts are preserved as historical records; a narrowed selector is not a new passed run. Audit1302: src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts: Keep production RPC dispatcher/terminal framing with emitted binary bytes, UTF-8 reconstruction and client ACK releasing genuinely withheld output; also keep the direct binary-subscribe chunk boundary. Remove shared-budget fairness matrix that sleeps real time and relies on exact synthetic per-stream window scheduling. Lose that eight-stream fairness/call wiring alarm; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts removed. Lose ORCA_TERMINAL_PERF_BENCH diagnostic report and local xterm parser measurements; this was not an ordinary CI assertion gate. No equivalent replacement coverage is claimed. Broader617 Mobile owner follow-up retires six whole work-count/timing registrations from mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts, retaining five functional handoff/readiness/absence/recovery registrations. Prior Audit1400 retained-but-unvalidated and archived inventories describe earlier source and remain historical after this follow-up. No equivalent replacement, fresh execution, timing measurement, physical phone, or deployed mixed-host validation is claimed by this source change. Current premerge review correction for the Broader617 Mobile owner follow-up: four additional whole mock-only/mock-produced-state stream registrations are retired, for ten total cuts and one unchanged retained registration, keeps asking until a tab snapshot replaces the exhausted handle. The preceding five-retained description records the superseded candidate, not current coverage. The retained case checks the real hook-owned recovery-needed result; handoff, readiness and absence-marker mock-delivery alarms are intentionally lost without equivalent replacement. Dead test render counting and unused handoff setup are removed. No new native, physical-phone, timing or deployed-host proof is implied.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/6951",
        "https://github.com/stablyai/orca/pull/6955",
        "https://github.com/stablyai/orca/pull/7009"
      ],
      "invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, batches, and aggregate in-flight credit. ACK means the renderer parsed the bytes or intentionally discarded them; receipt-time ACK is forbidden. A capability-negotiated hidden paired desktop stream must deliver zero raw output frames after host model ingestion, preserve side-effect facts, and restore from one authoritative snapshot before exact live output resumes. Every replay, stale-generation, malformed-frame, hidden-pane, eviction, disposal, error, and reconnect path must settle credit exactly once so streams neither leak memory nor stall. A terminal covered by native chat must restore from fresh scrollback when revealed, while preserving output order, input locks, resize/driver events, fairness, and safe mixed-version fallback.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Assert mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, live output queued while snapshots load stays <=256KB per stream, large output splits into <=48KB frames, and output bursts coalesce. Pause three negotiated paired desktop streams, sustain output, and assert zero renderer frames; reveal one and assert one authoritative snapshot followed by exact live bytes with no loss or duplication. Prove old clients continue receiving output and new clients never send pause to old hosts. Feed paired output through the xterm parse callback and prove ACK is deferred until parse or intentional discard, then inject stale generation, malformed/transformed frames, replay failure, queue eviction, hidden panes, pane disposal, ACK send failure, recovery serialization failure, and reconnect races; assert ordered replay and exactly-once credit settlement. Fill the aggregate window across bulk and interactive streams, ACK once, and prove round-robin progress. Run the opt-in 64 MiB/viewer RTT matrix to report modeled throughput, in-flight window use, completion spread and protocol-frame counts, plus model scheduler elapsed time. Measure @xterm/headless parser CPU and retained heap separately; the model does not qualify production credit enforcement. JSON fallback parity and live Android scrollback restoration remain explicit gaps.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 20,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: Focused runtime RPC contract tests passed locally on 2026-07-02; needs soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: The hidden paired-output oracle is red on origin/main, green on the candidate, and red with its causal host/protocol files reverted. It proves three paused streams emit no raw frames while an unpaused control remains live; compatibility tests preserve old-client/new-host output and prevent new-client/old-host pause opcodes. The broader gate remains partial pending legacy JSON fallback and live Android coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: Parsed/discarded credit uses 192 KiB/4 ms ACK batching, 512 KiB-to-2 MiB adaptive per-stream windows, a 2 MiB-to-8 MiB aggregate window, <=48 KiB output frames, <=256 KiB queued output per stream, and <=32 streams per connection (8 MiB aggregate pending output). Negotiated hidden paired streams add zero renderer output frames or scheduler drains after host ingestion; headed and headless six-stream runs enforce under 500 ms timer lag. The 64 MiB/viewer model gate requires >7 MiB/s/viewer at 100 ms RTT, <200 ms completion spread, and aggregate in-flight bytes <=8 MiB."
      },
      "promotionCriteria": [
        "Gate binary multiplex first.",
        "Decide whether JSON fallback is supported, gated, or deprecated.",
        "Record byte counts and order/cursor artifacts on failure."
      ],
      "knownGaps": [
        "The pure mobile decision gate does not yet prove live Android WebView scrollback restore after a chat toggle.",
        "Legacy JSON subscribe parity is undecided.",
        "The parser measurement uses @xterm/headless; browser renderer/WebGL CPU, GPU, and allocation behavior still need packaged-app performance evidence.",
        "The audit removed the PTY ACK wrapper suite, which replayed credit arithmetic with mocked IPC. Its isolated wrapper alarms are no longer registered here; generic credit and runtime stream tests do not establish equivalent PTY integration coverage.",
        "The audit removes the standalone auto-settle-before-deferred-claim example. Nested-owner and claimed-child completion tests remain; they do not establish that removed timing alarm.",
        "The test-value audit removes the pure mobile stream-decision suite: pause/resume/rearm/viewport branch inventories no longer have that isolated alarm. The surviving stream-hook tests do not establish equivalent WebView restore, PTY resize, input-lease or subscription delivery coverage.",
        "Historical receipt before suite removal; original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-07-12\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts\",\"result\":\"passed\",\"durationSeconds\":0.2,\"summary\":\"The focused mobile native-chat suite passed with 3 terminal-stream lifecycle assertions in the staged PR #5824 worktree.\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/session/native-chat/mobile-native-chat-terminal-stream.test.ts\"}",
        "Audit1302: src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts: Keep production RPC dispatcher/terminal framing with emitted binary bytes, UTF-8 reconstruction and client ACK releasing genuinely withheld output; also keep the direct binary-subscribe chunk boundary. Remove shared-budget fairness matrix that sleeps real time and relies on exact synthetic per-stream window scheduling. Lose that eight-stream fairness/call wiring alarm; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim.",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-03\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 3.8,\n          \"summary\": \"3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout.\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 9.05,\n          \"summary\": \"All 58 terminal multiplex tests passed, including the three-stream hidden-output oracle. Its byte-identical title-selected command failed on current origin/main and failed again with the two causal host/protocol files reverted because hidden Output frames reached the renderer.\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 7.76,\n          \"summary\": \"Test Files  5 passed (5); Tests  30 passed (30). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 9.59,\n          \"summary\": \"Test Files  7 passed (7); Tests  44 passed (44). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1302 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts --maxWorkers=1\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 18.12,\n          \"summary\": \"Test Files  12 passed (12); Tests  165 passed (165). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands.",
        "Archived audit1341 scope1334 historical receipt (original command/currentCommand/result/count/duration unchanged; not evidence for the shortened suite): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 node /home/neil/orca/workspaces/orca/comprehensive-test-audit-10/build/audits/audit1290-combined-low-value-tests/validation/mobile/node_modules/vitest/vitest.mjs run --config mobile/vitest.config.ts mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm --dir mobile exec vitest run --root .. mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts\",\"result\":\"passed\",\"durationSeconds\":0.48,\"summary\":\"Test Files  1 passed (1); Tests  18 passed (18). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts removed. Lose ORCA_TERMINAL_PERF_BENCH diagnostic report and local xterm parser measurements; this was not an ordinary CI assertion gate. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-22\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 0.91,\n          \"summary\": \"The 1/20/100 ms RTT x 1/4/8 viewer matrix stayed at or below 8 MiB in flight with zero completion spread. At 100 ms it modeled 18.8 MiB/s per viewer for 1-4 viewers and 9.7 MiB/s for 8 viewers. Measured @xterm/headless parsing was 26.7/63.6/95.3 aggregate MiB/s for 1/4/8 viewers, with 84.4/236.5/336.0 ms CPU and 2893/13409/28991 KiB retained heap for 4 MiB per viewer.\"\n        }",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\n          \"result\": \"skipped\",\n          \"durationSeconds\": 2.12,\n          \"summary\": \"Test Files  1 skipped (1); Tests  1 skipped (1). Benchmark opt-in was absent in this recorded run; no benchmark validation.\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n    \"assertions\": [\n      \"legacy binary output queued during initial snapshot serialization stays bounded\",\n      \"stale mobile resize re-stream completions are dropped for legacy binary streams\",\n      \"aborted stream signals do not register stale listeners\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-output-batching.test.ts\",\n    \"assertions\": [\n      \"desktop output bursts coalesce before stream emission\",\n      \"large binary output is encoded lazily before the first output frame\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n    \"assertions\": [\n      \"requested snapshots fall back smaller when serialized data exceeds the send budget\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts\",\n    \"assertions\": [\n      \"oversized live output frames are bounded for subscribed binary streams\",\n      \"multibyte live output flushes when encoded bytes reach the batch budget\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts\",\n    \"assertions\": [\n      \"send and recovery serialization failures detach once instead of leaking credit or retrying forever\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n    \"assertions\": [\n      \"32 active or pending slots cap aggregate queued output and repeated pending-slot subscribe cancels its older waiter\"\n    ]\n  },\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\n    \"assertions\": [\n      \"three negotiated hidden desktop streams emit zero output frames under sustained load while an unpaused stream remains live\",\n      \"an older client that omits pause negotiation continues receiving output\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n    \"assertions\": [\n      \"a runtime-owned hidden pane pauses output, consumes status/title/theme facts, and keeps input writable\",\n      \"reveal resumes before one authoritative snapshot and exact live output with no hidden raw write, loss, or duplication\",\n      \"dispose releases pause and unregisters the fact consumer\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n    \"assertions\": [\n      \"desired pause reapplies after either capability/snapshot ordering and across reconnect\",\n      \"reconnect delivers each authoritative snapshot and post-resume live marker exactly once\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts\",\n    \"assertions\": [\n      \"nested synchronous deliveries restore the outer credit owner\",\n      \"every claimed scheduler child must settle before the parent credits\"\n    ]\n  },\n  {\n    \"file\": \"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts\",\n    \"assertions\": [\n      \"paired renderer ACK waits for the output scheduler captured parse callback before releasing encoded-byte credit\",\n      \"unknown stream output is unsubscribed and malformed framing closes the connection; malformed transformed data is discarded and credited before resync\",\n      \"an ACK write failure tears down the stream with zero rearmed flush timers under fake time\"\n    ]\n  },\n  {\n    \"file\": \"mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts\",\n    \"assertions\": [\n      \"trades a lease-only stream for output when a chat tab hands off to a terminal tab\",\n      \"repairs a lease-only stream once its WebView reports ready\",\n      \"stops rearming a handle whose stream never comes back (covered: %s, #10681)\",\n      \"does not charge the rearm budget for a subscribe its own gates turned away\",\n      \"charges the rearm budget for a subscribe the bridge refused before returning\",\n      \"refills the rearm budget when terminal.list reports the handle again (covered: %s, #10681)\",\n      \"does not let a dead PTY buy a new budget with its own `subscribed` ack\",\n      \"refills the budget for a rearmed stream that outlives the teardown window\",\n      \"keeps an absence marker observed before the budget ran out\",\n      \"keeps asking until a tab snapshot replaces the exhausted handle\",\n      \"resumes a cold-start lease-only stream when WebView readiness arrives late\"\n    ]\n  }\n]",
        "Audit1400 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\n    \"assertions\": [\n      \"the opt-in benchmark reports modeled RTT throughput, window use, protocol-frame counts and completion spread, with model scheduler elapsed time and separately measured @xterm/headless parser CPU and retained heap\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\n          \"assertions\": [\n            \"legacy binary output queued during initial snapshot serialization stays bounded\",\n            \"stale mobile resize re-stream completions are dropped for legacy binary streams\",\n            \"aborted stream signals do not register stale listeners\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-output-batching.test.ts\",\n          \"assertions\": [\n            \"desktop output bursts coalesce before stream emission\",\n            \"large binary output is encoded lazily before the first output frame\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\n          \"assertions\": [\n            \"requested snapshots fall back smaller when serialized data exceeds the send budget\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts\",\n          \"assertions\": [\n            \"oversized live output frames are bounded for subscribed binary streams\",\n            \"multibyte live output flushes when encoded bytes reach the batch budget\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts\",\n          \"assertions\": [\n            \"send and recovery serialization failures detach once instead of leaking credit or retrying forever\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\n          \"assertions\": [\n            \"32 active or pending slots cap aggregate queued output and repeated pending-slot subscribe cancels its older waiter\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\n          \"assertions\": [\n            \"three negotiated hidden desktop streams emit zero output frames under sustained load while an unpaused stream remains live\",\n            \"an older client that omits pause negotiation continues receiving output\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\n            \"a runtime-owned hidden pane pauses output, consumes status/title/theme facts, and keeps input writable\",\n            \"reveal resumes before one authoritative snapshot and exact live output with no hidden raw write, loss, or duplication\",\n            \"dispose releases pause and unregisters the fact consumer\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts\",\n          \"assertions\": [\n            \"desired pause reapplies after either capability/snapshot ordering and across reconnect\",\n            \"reconnect delivers each authoritative snapshot and post-resume live marker exactly once\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts\",\n          \"assertions\": [\n            \"nested synchronous deliveries restore the outer credit owner\",\n            \"every claimed scheduler child must settle before the parent credits\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts\",\n          \"assertions\": [\n            \"paired renderer ACK waits for the output scheduler captured parse callback before releasing encoded-byte credit\",\n            \"unknown stream output is unsubscribed and malformed framing closes the connection; malformed transformed data is discarded and credited before resync\",\n            \"an ACK write failure tears down the stream with zero rearmed flush timers under fake time\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\n          \"assertions\": [\n            \"the opt-in benchmark reports modeled RTT throughput, window use, protocol-frame counts and completion spread, with model scheduler elapsed time and separately measured @xterm/headless parser CPU and retained heap\"\n          ]\n        },\n        {\n          \"file\": \"mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts\",\n          \"assertions\": [\n            \"trades a lease-only stream for output when a chat tab hands off to a terminal tab\",\n            \"repairs a lease-only stream once its WebView reports ready\",\n            \"stops rearming a handle whose stream never comes back (covered: %s, #10681)\",\n            \"does not charge the rearm budget for a subscribe its own gates turned away\",\n            \"charges the rearm budget for a subscribe the bridge refused before returning\",\n            \"refills the rearm budget when terminal.list reports the handle again (covered: %s, #10681)\",\n            \"does not let a dead PTY buy a new budget with its own `subscribed` ack\",\n            \"refills the budget for a rearmed stream that outlives the teardown window\",\n            \"keeps an absence marker observed before the budget ran out\",\n            \"keeps asking until a tab snapshot replaces the exhausted handle\",\n            \"resumes a cold-start lease-only stream when WebView readiness arrives late\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=1\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts --maxWorkers=1\",\"ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\"pnpm --dir mobile exec vitest run --root .. mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts\"],\"testFiles\":[\"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts\",\"src/main/runtime/rpc/terminal-output-batching.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts\",\"src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts\",\"src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts\",\"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts\",\"src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts\",\"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts\",\"src/renderer/src/runtime/runtime-terminal-stream.test.ts\",\"mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts\"]}",
        "Broader617 Mobile owner follow-up retires six whole work-count/timing registrations from mobile/src/session/native-chat/use-mobile-native-chat-terminal-stream.test.ts, retaining five functional handoff/readiness/absence/recovery registrations. Prior Audit1400 retained-but-unvalidated and archived inventories describe earlier source and remain historical after this follow-up. No equivalent replacement, fresh execution, timing measurement, physical phone, or deployed mixed-host validation is claimed by this source change.",
        "Current premerge review correction for the Broader617 Mobile owner follow-up: four additional whole mock-only/mock-produced-state stream registrations are retired, for ten total cuts and one unchanged retained registration, keeps asking until a tab snapshot replaces the exhausted handle. The preceding five-retained description records the superseded candidate, not current coverage. The retained case checks the real hook-owned recovery-needed result; handoff, readiness and absence-marker mock-delivery alarms are intentionally lost without equivalent replacement. Dead test render counting and unused handoff setup are removed. No new native, physical-phone, timing or deployed-host proof is implied."
      ],
      "demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
    },
    {
      "id": "terminal-mirror.parser-parity",
      "title": "Renderer xterm and main headless mirror parse identical bytes into identical cells",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-main-parity-contract",
      "surfaces": [
        "main mirror buffer",
        "snapshot restore",
        "terminal reads",
        "mobile streams",
        "unicode width",
        "parser configuration"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS evidence over #7148's width-parity oracle on main@1282f5c2d. A broader byte corpus, a shared parser-construction assertion over terminal-unicode-provider.ts/pane-terminal-options.ts, and recorded agent-session corpora remain gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7148",
        "https://github.com/stablyai/orca/pull/7133"
      ],
      "invariant": "The main-process headless terminal mirror and the renderer xterm must parse identical byte streams into cell-identical buffers (unicode width tables, joining behavior, modes, and addon-visible semantics), so snapshots, restores, reads, and mobile streams never encode a frame the renderer would not have produced.",
      "oracle": "Feed identical byte corpora (emoji/ZWJ/wide glyphs, positioned overwrites after wide characters, alternate-screen transitions, wrapped lines) to both parser configurations and assert cell-identical visible buffers; both parsers must be constructed from one shared configuration module so one-sided drift fails the gate.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "shared parser-parity unit gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Deterministic unit-layer corpus; no timing dependence expected."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "#7148 proved this red before its fix (positioned overwrite after emoji landed shifted in the mirror). Intentional-drift proof for the shared provider is still missing."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Shared parser construction must not add renderer or emulator startup cost; the corpus stays a bounded unit fixture."
      },
      "promotionCriteria": [
        "Register #7148's merged width test (src/main/daemon/headless-emulator-unicode-width.test.ts) plus a shared-construction assertion over src/shared/terminal-unicode-provider.ts and pane-terminal-options.ts as the first command during the stack rebase.",
        "Extend the corpus with recorded real agent-session byte streams.",
        "Promote only on aggregated reliability-gates CI history."
      ],
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "No manifest command yet; the seed test exists on fresh main but not at this branch's merge-base.",
        "Width parity is protected only by #7148's single test; no broader corpus or shared-construction assertion covers the other parser-config axes.",
        "Corpus does not yet include recorded live agent sessions.",
        "Parity at identical configuration cannot catch state-synchronization divergence such as #7192's stale-width mirror; geometry fan-out and reflow ordering are owned by terminal-geometry.visible-convergence."
      ],
      "demotionRule": "Cannot promote without cell-exact parity assertions over a wide-glyph corpus and shared-construction proof."
    },
    {
      "id": "terminal-observability.restore-convergence-selfcheck",
      "title": "Post-restore convergence self-check flags renderer/mirror divergence as an anomaly",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "renderer-observability",
      "surfaces": ["hidden-output restore", "snapshot replay", "anomaly breadcrumbs", "telemetry"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Registered gap only; the anomaly-breadcrumb machinery exists in this branch but no convergence probe is implemented.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7133",
        "https://github.com/stablyai/orca/pull/7054"
      ],
      "invariant": "After every hidden-to-visible reveal settles — whether or not a restore was triggered — the renderer buffer must converge with the current main-mirror state; divergence is recorded as a compact, content-free terminal_lifecycle_anomaly breadcrumb and counted in telemetry instead of failing silently. Restore-scoped checking is insufficient: #7173's frozen-output variant restores faithfully and then silently drops later hidden output, so it never triggers another restore.",
      "oracle": "Deterministic tests inject forced divergence in both shapes — stale bytes written after a faithful restore, and a frozen pane whose reveal triggers no restore — and assert exactly one deduped breadcrumb with row-hash evidence and no terminal content; the production probe is a bounded row-hash sample comparison against current mirror rows that runs once per reveal with no polling and a strict time budget.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "renderer observability unit gate"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Probe and tests not yet implemented."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Needs an intentionally divergent restore fixture proving the probe fires, dedupes, and stays silent on faithful restores."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "One bounded comparison per reveal; no polling, no hot-path work, no content serialization beyond hashed row samples."
      },
      "promotionCriteria": [
        "Prove the probe is content-free and privacy-safe (hashes and indices only).",
        "Prove zero false positives across the existing restore test corpus before enabling telemetry counting.",
        "Watch anomaly telemetry after each terminal release as the in-production regression signal."
      ],
      "knownGaps": [
        "No manifest command yet.",
        "Probe not implemented; #7133-class and #7173-class corruption is currently silent in production.",
        "Pixel-level divergence is out of scope for this probe (see terminal-render.pixel-refresh-repair).",
        "Renderer-vs-mirror comparison cannot see corruption upstream of the mirror itself (#7192's stale-width mirror); mirror-vs-PTY truth is owned by terminal-geometry.visible-convergence."
      ],
      "demotionRule": "Disable the probe if it exceeds its per-reveal budget or produces false-positive anomaly noise."
    },
    {
      "id": "terminal-render.atlas-recovery-fanout",
      "title": "Ordinary terminal output avoids shared atlas recovery fanout",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-rendering",
      "layer": "renderer-unit-and-electron",
      "surfaces": [
        "WebGL rendering",
        "document visibility",
        "hidden terminal output",
        "alternate-screen redraws",
        "paired terminal traffic"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3349 retires the whole terminal-render-desync-sentinel suite, including the same-cells persistence/recovery alarm, without equivalent replacement. Its unit command selector, test-file selector and assertion reference are removed prospectively. Earlier global-effects/window-wake retirements and the retired dated sentinel receipt remain historical verbatim. Two unrelated macOS document-visibility E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh GPU/rendered UI, runtime, historical-import, mobile, mixed-version or cross-platform validation is claimed. NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: recovers visible terminal rendering and input when the window regains focus — Whole suite: fake React useEffect immediately invokes bodies and ignores cleanup/deps; fake useRef/store hooks plus mocked pane manager only assert callback choreography. Does not exercise window focus, actual input or pixels. Retires focus wake wiring alarm.; clears WebGL texture atlases when the OS resumes — Whole suite: same fake-hook harness invokes captured OS resume callback and counts mocked atlas-clear/repaint methods. No GPU, actual OS resume, or real hook lifetime. Retires atlas clear wiring alarm.; preserves WebGL texture atlases when the active terminal document becomes visible — Whole suite: direct fake document visibility listener and mock-call absence/presence under fake hooks cannot establish real WebGL preservation or cleanup. Retires visibility wake wiring alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed. Historical coverage account: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic renderer contracts require foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output to stay on pane-local repaint paths without a global atlas reset. Separate contracts preserve explicit paste, reveal, visibility-resume, system-resume, and confirmed-desync recovery. A macOS Electron run verifies that a document visibility cycle preserves real WebGL atlases and terminal pixels; the candidate has not been rerun against an isolated live paired server. The test-value audit removed registry recovery fanout, visibility, ordering and failure-isolation assertions. The remaining registry test constrains diagnostic sampling only and is excluded from this gate. No equivalent recovery coverage is claimed. Completed settled tab-reveal repaint execution is not covered after removal of pane-reveal-repaint.test.ts. The separate terminal-visibility-resume tests assert mocked scheduling and presentation calls; they do not establish completed repaint execution. Audit1342: src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts removed. Context resume/reveal retry and deferred rebuild mock-pane alarms disappear. No equivalent replacement coverage is claimed. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7054",
        "https://github.com/stablyai/orca/pull/7604",
        "https://github.com/stablyai/orca/issues/12094"
      ],
      "invariant": "Ordinary PTY output must never clear the shared WebGL glyph atlas, including synchronized frames, hidden output, renderer-risk glyphs, and alternate-screen entry, redraw, or exit. Affected visible panes still receive pane-local refresh after parsing. Explicit paste, reveal, visibility-resume, system-resume, context-loss, and confirmed-desync recovery remain available and may reset visible renderers.",
      "oracle": "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3349 retires the whole terminal-render-desync-sentinel suite, including the same-cells persistence/recovery alarm, without equivalent replacement. Its unit command selector, test-file selector and assertion reference are removed prospectively. Earlier global-effects/window-wake retirements and the retired dated sentinel receipt remain historical verbatim. Two unrelated macOS document-visibility E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh GPU/rendered UI, runtime, historical-import, mobile, mixed-version or cross-platform validation is claimed. Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: recovers visible terminal rendering and input when the window regains focus — Whole suite: fake React useEffect immediately invokes bodies and ignores cleanup/deps; fake useRef/store hooks plus mocked pane manager only assert callback choreography. Does not exercise window focus, actual input or pixels. Retires focus wake wiring alarm.; clears WebGL texture atlases when the OS resumes — Whole suite: same fake-hook harness invokes captured OS resume callback and counts mocked atlas-clear/repaint methods. No GPU, actual OS resume, or real hook lifetime. Retires atlas clear wiring alarm.; preserves WebGL texture atlases when the active terminal document becomes visible — Whole suite: direct fake document visibility listener and mock-call absence/presence under fake hooks cannot establish real WebGL preservation or cleanup. Retires visibility wake wiring alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Retained exact unchanged-source receipts remain the only current execution evidence. Reduced selectors have no fresh execution result. Historical pre-audit oracle account for changed sources: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Parse foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output and require pane-local refresh where needed with zero calls to shared reset-and-refresh recovery. Require the atlas-recovery module to expose only explicit lifecycle entry points, then verify paste recovery. Completed settled tab-reveal repaint is not verified by the remaining unit evidence. Dispatch a visible document visibilitychange and require atlas-preserving wake recovery. Separately, drive an Electron visibility cycle with two real WebGL panes, require zero atlas clears, and retain at least 85% of each pane's baseline ink pixels.",
      "commands": [
        "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
      ],
      "testFiles": ["tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts",
          "assertions": [
            "preserves the WebGL atlas and keeps terminal text painted after document visibility resumes"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-01",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "result": "passed",
          "durationSeconds": 18,
          "summary": "The changed-spec CI topology retained both real WebGL terminal panes with zero atlas clears after a deterministic document visibility cycle."
        },
        {
          "date": "2026-08-01",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 23,
          "summary": "Two real WebGL terminal panes retained painted glyphs with zero atlas clears after a deterministic document visibility cycle. BrowserWindow.hide did not change document visibility in the harness, so the test used its explicit visibility-event fallback."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The focused unit oracle and one local Electron run passed; CI soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Before the change, foreground renderer-risk and alternate-screen PTY writes requested terminal-output atlas recovery after parsing; hidden synchronized/TUI output also drove the same path. The updated oracle spies on that request before its removed 200ms debounce and on the eventual shared reset, while explicit lifecycle recovery remains required. Historical evidence includes assertions subsequently removed in the test-value audit; it does not establish their current coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. A 120-frame foreground redraw at 300ms cadence produced 13 terminal-output atlas reset cycles before the change and zero afterward over 37.470 seconds. Ordinary PTY output now adds no atlas debounce, retry timer, buffer-switch listener, global manager traversal, provider call, or recurring work; pane-local refresh remains for renderer-risk output. Explicit heavy recovery still touches visible managers only."
      },
      "promotionCriteria": [
        "Accumulate stable macOS Electron runs with real BrowserWindow visibility transitions.",
        "Run an isolated headed paired-server terminal flood and verify renderer CPU and atlas diagnostics remain flat under ordinary output.",
        "Add Linux and Windows WebGL visibility evidence before claiming cross-platform visual coverage."
      ],
      "knownGaps": [
        "NEXT65 current scope qualification: The NEXT65 knownGaps entries below govern the changed selectors and qualify any broader coverage implication in this gate’s unchanged oracle/coverageNotes narratives. Those narratives and preserved dated evidenceRuns retain their historical text and original exact execution scopes only; no fresh execution, transferred pass or equivalent replacement coverage is claimed. Upstream case removals remain upstream; original NEXT65 proposal descriptions grant no duplicate retirement credit.",
        "NEXT65 active selector scope reduction (including directory-selected whole-file retirements): src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts. Remove complete registrations or registrar files within the selected scope for src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-daemon-snapshot-replay.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode-2031-subscriptions.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/reattach/pty-connection-stale-daemon-snapshot-replay.spec.ts. Intentionally lose these named regression alarms without replacement: catches a subscribed pane up once per mode change across repeated reconnects — Mode2031 theme reporting catch-up/deduplication across repeated reconnects loses this direct protocol example.; defers to the viewer holding the grid, then catches up once on release — Held-grid viewer deferral and one catch-up/current-mode resending on release lose this direct protocol example.; clears the captured pen for a normal-buffer fallback reattach — Fallback normal-buffer reattach clearing captured pen and dirty background loses this direct example.; waits for a recovered destination fit before forwarding its grid or live output — Recovered destination fitting before forwarding grid or live output loses this direct example.; suppresses the deferred reattach grid push when mobile claims the PTY while hidden — Mobile takeover while hidden suppressing deferred reattach grid forwarding loses this direct example.; drops stale callbacks but delivers fresh replacement output after an old replay clear — Fresh replacement output winning over stale callbacks after old replay clear loses this direct example.. Surviving parent statements and sibling registrations are preserved, but these reduced parent selectors have no fresh execution or transferred historical pass. Unrelated complete dated receipts retain only their original exact scopes; no equivalent replacement, rendered UI, provider, mobile, or cross-platform coverage is claimed.",
        "NEXT65 historical original active parent-selector fields (verbatim native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\",\n          \"assertions\": [\"persists and recovers after the same cells stay missing twice\"]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\"keeps hidden synchronized output off the global atlas recovery path\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\",\n          \"assertions\": [\n            \"preserves the WebGL atlas and keeps terminal text painted after document visibility resumes\"\n          ]\n        }\n      ]",
        "Audit3061 retires the park-model supplied snapshot suite and nominal mode, cursor, focus, geometry and remote resume metadata variants. Their distinct alarms are intentionally lost; six retained mode/remote cases preserve selected tail-order, authority and parse-readiness boundaries without equivalent replacement. Existing selectors and dated evidence retain their original scope.",
        "Audit3053 reduces hidden-replay coverage by retiring nominal overlap, resize, cursor metadata and standalone stalled-restore variants. Timeout, overflow, identity/generation fences and retained live-output coordination remain; the removed alarms are intentionally lost without equivalent replacement. Existing commands, assertion references and dated evidence retain their original scope.",
        "Audit3037 removes seven supplied-input baseline cases from the terminal-input-gating registrar. Input-and-repaint wrapper selectors and unrelated assertions remain; historical receipts do not validate the reduced source bytes. No renewed atlas, renderer, native or performance evidence is claimed.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts. Unresolved local/computed edges remain explicit debt. Retired active assertionRefs (raw original objects retained as historical only): {\n          \"file\": \"src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts\",\n          \"assertions\": [\"limits atlas recovery to explicit renderer lifecycle events\"]\n        }",
        "The Electron harness used a deterministic visibility-event fallback because BrowserWindow.hide did not change document.visibilityState.",
        "No isolated live paired-server candidate run is recorded; remote-runtime coverage is a provider-agnostic renderer contract plus production incident evidence.",
        "The gate counts recovery fanout and pixel retention but does not impose an end-to-end renderer frame-latency threshold.",
        "The test-value audit removed registry recovery fanout, visibility, ordering and failure-isolation assertions. The remaining registry test constrains diagnostic sampling only and is excluded from this gate. No equivalent recovery coverage is claimed.",
        "Completed settled tab-reveal repaint execution is not covered after removal of pane-reveal-repaint.test.ts. The separate terminal-visibility-resume tests assert mocked scheduling and presentation calls; they do not establish completed repaint execution.",
        "Audit1342: src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts removed. Context resume/reveal retry and deferred rebuild mock-pane alarms disappear. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-10\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 47,\n          \"summary\": \"All 625 focused renderer contracts passed on the final head for atlas-preserving visibility, visible-only heavy recovery fanout, confirmed-desync and context-loss recovery, explicit lifecycle recovery, pane-local foreground redraws, and zero ordinary-output atlas resets. Historical command preserved after the test-value audit removed the referenced reveal/repaint or registry recovery assertions. currentCommand is an administrative link; this historical run has not validated the remaining command or equivalent coverage.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection-input-and-repaint.test.ts\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts\",\n    \"assertions\": [\n      \"recovers a context-lost pane on the next rendering resume\"\n    ]\n  }\n]",
        "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1417 intentionally deletes src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.spec.ts: Loses rich hidden snapshot sequence replay/grid resize and forced repaint after hidden snapshot alarms, including live-trigger deduplication. No equivalent replacement coverage or fresh result is claimed.",
        "Issue #22458 removes non-Windows repaint tests that only assert private synchronous refresh calls. Their renderer-risk and alternate-screen atlas assertions are no longer registered; historical results do not validate equivalent coverage.",
        "Audit3326 adopts reconciled source audit3324 and intentionally retires these low-value examples and their regression alarms: recovers visible terminal rendering and input when the window regains focus — Whole suite: fake React useEffect immediately invokes bodies and ignores cleanup/deps; fake useRef/store hooks plus mocked pane manager only assert callback choreography. Does not exercise window focus, actual input or pixels. Retires focus wake wiring alarm.; clears WebGL texture atlases when the OS resumes — Whole suite: same fake-hook harness invokes captured OS resume callback and counts mocked atlas-clear/repaint methods. No GPU, actual OS resume, or real hook lifetime. Retires atlas clear wiring alarm.; preserves WebGL texture atlases when the active terminal document becomes visible — Whole suite: direct fake document visibility listener and mock-call absence/presence under fake hooks cannot establish real WebGL preservation or cleanup. Retires visibility wake wiring alarm.. Retained tests do not replace these alarms. Dated unrelated evidence remains scoped to its original execution; no historical source/import-closure equivalence, fresh execution, real network/provider/SSH, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\",\n          \"assertions\": [\"persists and recovers after the same cells stay missing twice\"]\n        },\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\"keeps hidden synchronized output off the global atlas recovery path\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\",\n          \"assertions\": [\n            \"preserves the WebGL atlas and keeps terminal text painted after document visibility resumes\"\n          ]\n        }\n      ]",
        "Audit3349 retires the whole terminal-render-desync-sentinel suite, including the same-cells persistence/recovery alarm, without equivalent replacement. Its unit command selector, test-file selector and assertion reference are removed prospectively. Earlier global-effects/window-wake retirements and the retired dated sentinel receipt remain historical verbatim. Two unrelated macOS document-visibility E2E receipts remain verbatim; the frozen static closure does not select changed tests through their literal roots. No fresh GPU/rendered UI, runtime, historical-import, mobile, mixed-version or cross-platform validation is claimed.",
        "Audit3349 historical original commands object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\"",
        "Audit3349 historical original testFiles object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\"",
        "Audit3349 historical original assertionRefs object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/components/terminal-pane/render-health/terminal-render-desync-sentinel.test.ts\",\n          \"assertions\": [\"persists and recovers after the same cells stay missing twice\"]\n        }",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts\",\n        \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts\",\n          \"assertions\": [\"keeps hidden synchronized output off the global atlas recovery path\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts\",\n          \"assertions\": [\n            \"preserves the WebGL atlas and keeps terminal text painted after document visibility resumes\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Demote if ordinary PTY output re-enters shared reset/refresh recovery, pane-local redraw coverage regresses, ordinary visibility clears the atlas, real WebGL pixels regress, or the focused Electron test cannot remain deterministic."
    },
    {
      "id": "terminal-render.atlas-identity-invalidation",
      "title": "A WebGL atlas identity change rebuilds cached glyph vertices",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-rendering",
      "layer": "electron-visual-golden",
      "surfaces": ["WebGL rendering", "shared glyph atlas", "render model"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1299 removes tests/e2e/terminal-webgl-atlas-budget.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/8899"],
      "invariant": "Whenever GlyphRenderer attaches a different shared atlas, every cached glyph vertex is rebuilt before the next draw even if the old and new atlases have the same clear-model generation.",
      "oracle": "No current automated oracle after audit1299 retires the private third-party atlas fixture. Historical alarms and complete receipts remain archived in knownGaps.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "fresh E2E build plus two real-WebGL atlas tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The focused local macOS run and the PR's macOS golden experiment job passed. The Linux golden job skipped both WebGL atlas tests because WebGL was unavailable; soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The old setAtlas behavior deterministically changed 327,165 pixels after replacement; setting the last-seen generation to an invalid value on identity change produced zero changed pixels."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The added work is one existing full-model rebuild only when atlas object identity changes; ordinary frames and repeated setAtlas calls with the same object take the existing path. The field sentinel remains off by default, samples only a modifier-clicked pane in a bounded ten-second burst, reuses and releases one readback canvas, and caps renderer and disk evidence."
      },
      "promotionCriteria": [
        "Accumulate stable macOS and Linux GPU runs across the release golden suite.",
        "Add Windows GPU evidence or retain the platform gap explicitly.",
        "Remove the flag-gated field sentinel after the confirmation window while keeping this pixel regression."
      ],
      "knownGaps": [
        "The historical field capture predates renderer-internal atlas identity diagnostics, so it cannot prove this exact transition retrospectively.",
        "The deterministic test drives the renderer transition directly rather than reproducing the original Cmd/Ctrl-click lifecycle trigger.",
        "Windows GPU evidence is not yet recorded.",
        "Audit1299 removes tests/e2e/terminal-webgl-atlas-budget.spec.ts. Private-state/work-budget/assembled-fixture alarms are intentionally lost; retained suites are not equivalent replacement coverage. No new runtime/platform evidence is claimed.",
        "Archived retired-suite historical receipt (JSON, original fields/results unchanged): {\"date\":\"2026-07-17\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-webgl-atlas-budget.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\",\"result\":\"passed\",\"durationSeconds\":44,\"summary\":\"Both real-WebGL scenarios passed. The atlas-replacement case changed 327,165 pixels with the old generation adoption and zero pixels after identity invalidation.\"}"
      ],
      "demotionRule": "Keep experimental or demote to protection none if GPU skips hide the transition, the pixel oracle flakes across stable runners, or the test no longer fails with generation adoption restored."
    },
    {
      "id": "terminal-render.pixel-refresh-repair",
      "title": "Forced repaint does not change revealed pane pixels",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-rendering",
      "layer": "electron-visual-golden",
      "surfaces": [
        "WebGL rendering",
        "tab reveal",
        "worktree resume",
        "window wake",
        "render model"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts, src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence. The entire dated 98-contract renderer receipt is retired whole, with all original command/currentCommand/date/count/result fields preserved as historical. Historical prior account (preserved verbatim): A headed macOS Electron test drives explicit destructive atlas recovery while DEC 2026 output is held, then compares compositor screenshots before and after a direct full-buffer present. The same renderer choreography is provider-local, but daemon, SSH, remote-runtime, Linux, and Windows GPU runs remain gaps. The test-value audit removed registry recovery fanout, visibility, ordering and failure-isolation assertions. The remaining registry test constrains diagnostic sampling only and is excluded from this gate. No equivalent recovery coverage is claimed. The audit removes the canvas-DPR and render-pause-release unit suites and several renderer flag/retry examples. Their isolated DPR-cache, render-service routing and display-none retry alarms are no longer registered; retained unit and historical Electron evidence do not establish equivalent coverage. No live GPU rerun accompanies this administrative update.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7133",
        "https://github.com/stablyai/orca/pull/7054"
      ],
      "invariant": "After proven renderer damage triggers destructive recovery, visible pixels equal a full model-invalidating present of the current buffer.",
      "oracle": "Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence. Historical prior account (preserved verbatim): Hold DEC 2026, invoke explicit atlas recovery, require an atlas clear, screenshot the pane, force a direct renderer present, and assert the bounded pixel diff is immaterial. Compositor screenshots only, because WebGL canvas readback is blank with preserveDrawingBuffer disabled.",
      "commands": [
        "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
        "ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --repeat-each=3"
      ],
      "testFiles": ["tests/e2e/terminal-reveal-paused-render-repro.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/terminal-reveal-paused-render-repro.spec.ts",
          "assertions": ["@headful atlas recovery presents a synchronized-output WebGL frame"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-23",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 60,
          "summary": "Both headed oracles passed together. Explicit destructive atlas recovery presented the held synchronized-output buffer with zero pixels different from a direct renderer present; the test attached before/after screenshots plus pixel-diff metadata."
        },
        {
          "date": "2026-08-22",
          "runner": "local",
          "platform": "macos",
          "command": "ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --repeat-each=3",
          "result": "passed",
          "durationSeconds": 48,
          "summary": "Three consecutive headed real-WebGL runs passed in 15.0-15.7 seconds each and emitted a 1920x1080 video per BrowserWindow."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused prebuilt headed Electron visual test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Five local macOS headed runs passed, including one on the final branch state and three consecutive video-recorded repeats; CI soak history and cross-platform GPU runs are not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Without the forced synchronized-output present, the damaged compositor differed from a direct renderer present across 87.68% of pixels even though serialization already contained the new frame. With explicit destructive recovery, the same oracle passes the 1.5% material-diff threshold. Historical evidence includes assertions subsequently removed in the test-value audit; it does not establish their current coverage."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Destructive recovery remains event-driven and limited to confirmed renderer-lifecycle boundaries. Gate-local contracts prove ordinary same-DPR resize performs zero pane scans; a true transition scans only the visible manager; unavailable canvas retry is deduplicated and capped at 16 frames; and heavy reveal adds one bounded visible-pane scan. Registry visible-only fanout assertions were removed in the test-value audit; historical results do not establish their current coverage."
      },
      "promotionCriteria": [
        "Establish a stable material-diff threshold across platforms via nightly runs.",
        "Promotion means membership in the release-blocking terminal-rendering-golden suite that release-cut.yml runs against every release tag; never PR-blocking.",
        "Add Linux and Windows GPU evidence or retain those platform gaps explicitly."
      ],
      "knownGaps": [
        "The deterministic recovery test disables xterm's one-second safety timeout so the held-frame damage remains stable until recovery.",
        "The renderer-level frame injection isolates the paint failure; provider delivery and hidden-output snapshot restore have separate gates.",
        "Linux, Windows, daemon, SSH, and remote-runtime live GPU evidence is not yet recorded.",
        "The test-value audit removed registry recovery fanout, visibility, ordering and failure-isolation assertions. The remaining registry test constrains diagnostic sampling only and is excluded from this gate. No equivalent recovery coverage is claimed.",
        "The audit removes the canvas-DPR and render-pause-release unit suites and several renderer flag/retry examples. Their isolated DPR-cache, render-service routing and display-none retry alarms are no longer registered; retained unit and historical Electron evidence do not establish equivalent coverage. No live GPU rerun accompanies this administrative update.",
        "Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence.",
        "Audit1948 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-08-23\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2,\n          \"summary\": \"All 98 renderer contracts passed, including same-DPR zero-scan behavior, visible-only fanout, tri-state DPR repair, deduplicated bounded retry, heavy-reveal repair, and listener cleanup. Historical command preserved after the test-value audit removed the referenced reveal/repaint or registry recovery assertions. currentCommand is an administrative link; this historical run has not validated the remaining command or equivalent coverage. Administrative command maintenance removes deleted unit suites; the executed command and result are historical, with no rerun or equivalence claim.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts src/renderer/src/components/terminal-pane/viewport/visibility/use-terminal-window-wake-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\"\n        }",
        "Audit3335 retires the complete mocked window-wake recovery suite (11 authored registrations/12 expanded cases), intentionally losing fullscreen atlas-preservation, wake callback ordering, deferred-DPR deduplication/repair and private frame-budget alarms without equivalent replacement. The surviving focused selector is unexecuted in this source composition. Unrelated dated receipts keep their original scope; no fresh runtime/GPU/focus, rendered UI, mobile, mixed-version or cross-platform validation is claimed.",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts, src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\",\n        \"ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --repeat-each=3\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts\",\n        \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n        \"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\",\n        \"tests/e2e/terminal-reveal-paused-render-repro.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n          \"assertions\": [\"defers a heavy-reveal dpr present until the shared atlas recovery\"]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-reveal-paused-render-repro.spec.ts\",\n          \"assertions\": [\"@headful atlas recovery presents a synchronized-output WebGL frame\"]\n        }\n      ]"
      ],
      "demotionRule": "Drop from the golden suite back to nightly diagnostic if diff thresholds cannot be kept stable across CI runners."
    },
    {
      "id": "terminal-render.synchronized-reveal-coherence",
      "title": "Ordinary reveal preserves synchronized-output frame coherence",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-rendering",
      "layer": "electron-visual-golden",
      "surfaces": ["WebGL rendering", "tab reveal", "snapshot restore", "DEC 2026"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts, src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence. Historical prior account (preserved verbatim): A headed macOS Electron test uses a real xterm WebGL renderer and production tab reveal. It proves the coherent pre-hide canvas remains visible while DEC 2026 holds a newer buffer, then proves normal release and xterm's one-second watchdog publish complete frames. Renderer behavior is provider-neutral; live Linux, Windows, daemon, SSH, and remote-runtime GPU runs remain gaps. The audit removes isolated synchronized-frame viewport-present and render-pause-release unit examples. The historical headed Electron oracle remains recorded; retained scheduling tests do not establish equivalent render-service routing or completed-frame coverage. No live GPU rerun accompanies this administrative update.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/7133",
        "https://github.com/stablyai/orca/pull/7054"
      ],
      "invariant": "terminal-render.synchronized-reveal-coherence: an ordinary reveal never clears a healthy shared atlas or publishes a partially built DEC 2026 frame; it retains the last coherent canvas until release or xterm's bounded watchdog.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence. Historical prior account (preserved verbatim): Paint and capture a coherent frame, hide the real terminal tab, build a distinct full-screen frame while DEC 2026 is held, reveal through production, and require zero atlas clears plus pixel-equivalence with the coherent frame. Then release normally and through the one-second watchdog, requiring both compositor frames to match a direct renderer present.",
      "commands": [
        "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
      ],
      "testFiles": ["tests/e2e/terminal-reveal-paused-render-repro.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/terminal-reveal-paused-render-repro.spec.ts",
          "assertions": [
            "@headful reveal preserves the coherent frame until synchronized output releases"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-23",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
          "result": "passed",
          "durationSeconds": 53,
          "summary": "Both final-head headed oracles passed together. The coherent held frame differed by 73 of 1,404,288 pixels (0.0052%), ordinary reveal performed zero atlas clears, normal release differed from the direct present by 95 pixels (0.0068%), and watchdog release matched exactly. All three ratios passed the 1.5% compositor threshold."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 120,
        "scope": "focused prebuilt headed Electron prevention and watchdog test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "One final watchdog-inclusive macOS headed run passed; CI soak history and cross-platform GPU runs are not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Before the prevention change, the ordinary reveal oracle failed deterministically because it observed three atlas clears. After the change, reveal performs zero clears and the first visible frame remains pixel-equivalent to the coherent pre-hide frame."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Ordinary reveal removes three shared-atlas clears and their global visible-manager presents. It adds one settled, event-driven full-viewport refresh request per revealed pane; DEC 2026 coalesces it and uses xterm's existing one-second watchdog. No polling, subprocess, provider call, PTY inventory, background-output work, listener, or unbounded retry was added; the display-none retry remains deduplicated and capped at 16 frames."
      },
      "promotionCriteria": [
        "Accumulate stable macOS runs for both normal release and watchdog release.",
        "Add Linux and Windows GPU evidence or retain those platform gaps explicitly.",
        "Keep the destructive atlas-recovery oracle separate and passing."
      ],
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts. Unresolved local/computed edges remain explicit debt.",
        "The deterministic test injects full-screen marker frames through xterm rather than invoking a live model; genuine OpenCode full-window evidence separately proves the original corruption.",
        "Linux, Windows, daemon, SSH, and remote-runtime live GPU evidence is not yet recorded.",
        "The 1.5% compositor threshold tolerates cursor and shell-prompt timing noise; exact buffer content and atlas-clear counts are asserted separately.",
        "The audit removes isolated synchronized-frame viewport-present and render-pause-release unit examples. The historical headed Electron oracle remains recorded; retained scheduling tests do not establish equivalent render-service routing or completed-frame coverage. No live GPU rerun accompanies this administrative update.",
        "Audit1948: Audit1944 keeps the two snapshot/imageless restore cases but removes three real-clock delayed-scheduling/null-retry cases from pty-connection-hidden-runtime-snapshot.test.ts. Inactive split scheduling and its mock boundary alarms are intentionally lost. The changed source has no transferred historical pass, timing or equivalent-rendered-coverage claim. Independent unchanged headed Electron receipts retain only their original exact scopes; static metadata/source review is no fresh execution evidence.",
        "NEXT46 terminal-owner layout and whole-case policy: src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts, src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts. Complete retired/reduced selectors lose their listed alarms; retained cases have no transferred historical pass or equivalent replacement coverage. Unaffected dated receipts retain only their original exact scopes. This metadata edit is not fresh execution evidence.",
        "NEXT46 historical original active selector fields (verbatim JSON values; not current coverage):\ncommands: [\n        \"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\"\n      ]\ntestFiles: [\n        \"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-runtime-snapshot.test.ts\",\n        \"src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-hidden-backlog-snapshot.test.ts\",\n        \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n        \"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts\",\n        \"tests/e2e/terminal-reveal-paused-render-repro.spec.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/viewport/visibility/terminal-visibility-resume.test.ts\",\n          \"assertions\": [\n            \"schedules an atlas-preserving present on a light tab reveal\",\n            \"keeps heavy atlas recovery off a plain window refocus\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/terminal-reveal-paused-render-repro.spec.ts\",\n          \"assertions\": [\n            \"@headful reveal preserves the coherent frame until synchronized output releases\"\n          ]\n        }\n      ]"
      ],
      "demotionRule": "Demote if ordinary reveal clears the shared atlas, the held frame stops matching its coherent baseline, release/watchdog output diverges from a direct present, or the headed oracle cannot remain deterministic."
    },
    {
      "id": "pty-delivery.renderer-lifecycle-accounting-reset",
      "title": "Renderer lifecycle reset clears leaked PTY delivery accounting so surviving PTYs cannot freeze",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "main-unit",
      "surfaces": [
        "terminal output delivery",
        "renderer reload / crash recovery",
        "surviving daemon and local PTYs"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Local macOS unit evidence over the shared main-process delivery pipeline in registerPtyHandlers. The oracle drives a local mock PTY, but the in-flight/pending accounting is provider-agnostic and daemon PTYs ride the identical pipeline (the manual dev repro that proved the freeze was daemon-backed). SSH is a separate relay/credit path and never enters these counters; mobile/relay ride unaffected paths; WSL terminals ride this same local/daemon pipeline and are covered by the same accounting (no dedicated provider-contract test yet). Motivated by a production incident on v1.4.131 (three frozen/broken terminal panes in one desktop session) diagnosed to leaked in-flight/pending accounting across a renderer reload (rendererGraphEpoch 3). Live validation of the fix on a rebuilt dev instance surfaced a second leak mode (the boot window): after the reset ran, main resumed flushing a flooding PTY into the still-booting page before its pty:data listener re-registered, so those sends were dropped yet counted and re-pinned rendererInFlightChars at 524288. The gate now also covers holding sends until the renderer's pty:rendererDispatcherReady handshake. A watchdog self-heals a lost handshake: on each reset a one-shot ~10s timer arms and, if the handshake never arrives, force-opens the gate (rendererDispatcherReadyForcedCount increments) so a dropped handshake degrades to pre-handshake behavior instead of a permanent hold; the real handshake or a re-registration cancels it. Two new diagnostics — rendererPtyDispatcherReady and rendererDispatcherReadyForcedCount — expose the otherwise-invisible boot-window hold, which early-returns before ackGatedFlushSkipCount increments.",
      "motivatingLinks": [
        // #5787 is delivery-accounting lineage; this gate addresses v1.4.131’s three-frozen-panes incident (coverageNotes).
        "https://github.com/stablyai/orca/pull/5787",
        "https://github.com/stablyai/orca/pull/8034"
      ],
      "invariant": "After a renderer lifecycle reset (main-frame did-start-navigation / render-process-gone / destroyed), no surviving PTY remains delivery-gated by pre-reset unacked bytes: main's in-flight counters and pending backlog equal the true state of the new page (zero in-flight, zero pending). Delivery then resumes only once the reloaded page's pty:data dispatcher re-registers and signals pty:rendererDispatcherReady; during the boot window before that handshake main holds all sends (data accrues losslessly in the capped pending backlog) so bytes cannot be dropped into a listener-less page and re-pin the gate. The hold itself cannot become a permanent freeze: a one-shot ~10s watchdog armed on each reset force-opens the gate (incrementing rendererDispatcherReadyForcedCount) if the handshake is lost, and the real handshake or a re-registration cancels it. The reset fires only for a new-document main-frame navigation: did-start-navigation carries exact frame and same-document details, so overlapping subframe or in-page navigation never clears accounting or holds the gate on the still-alive page. If a renderer lifecycle edge is otherwise missed, a backstop still recovers: because the handshake is one-shot per page load, receiving pty:rendererDispatcherReady while the gate is already open proves a reset was missed (or the watchdog force-opened the gate), so the handler reconciles by clearing the stale accounting before re-opening. The renderer sends that handshake exactly once per page load, after its pty:data listener registers.",
      "oracle": "Ingest more than 512 KB of PTY output with no renderer ACKs and assert the per-PTY gate closes (sends stop at the 512 KB high-water, remainder accrues as pending). Fire the registered main-frame did-start-navigation listener and assert rendererInFlightChars and pendingChars are zero and the new diagnostics record the reset (rendererLifecycleResetCount 1, lastLifecycleResetClearedChars 512 KB). Then, before any dispatcher-ready handshake, ingest another chunk and assert it is NOT sent and NOT counted in-flight (held for the boot window, accruing in pending). Finally fire the pty:rendererDispatcherReady handshake and assert the held chunk is delivered to the renderer. Counters-zero without proving both the boot-window hold and that delivery resumes is insufficient. Additional cases prove the boot-window hold also covers the interactive direct-send fast path (input-primed keystroke echo is held, not sent, until the handshake) and that the self-heal watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) when no handshake arrives, while a timely handshake cancels the watchdog and leaves no orphaned timer. A further case opens the new page with a main-frame navigation and dispatcher handshake, then fires an overlapping subframe navigation and asserts the gate stays ready, the reset count stays at exactly one, and fresh output delivers without the watchdog — proving an iframe cannot reclose the live page. A backstop case saturates the gate, then fires pty:rendererDispatcherReady while the gate is still open (ready true) with no preceding reset — modeling a missed lifecycle edge — and asserts the handler reconciles: in-flight and pending clear, rendererLifecycleResetCount increments, and fresh output flows immediately (a straggler ACK is clamped and cannot underflow).",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "local main-process unit test"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Newly registered with this fix; needs soak history before any promotion. The oracle is deterministic (fake timers, mock webContents)."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Locally verified red/green on every load-bearing branch: (1) reset call removed -> rendererInFlightChars stays 524288 after main-frame did-start-navigation; (2) boot-window send-hold removed -> post-reload output is sent into the not-yet-ready page ('NOT sent until handshake' fails); (3) interactive-path flag check removed -> input-primed keystroke echo is sent during the hold; (4) watchdog arm removed -> the gate is never force-opened and the held backlog never drains; (5) watchdog cancel removed -> an orphaned ~10s timer survives the handshake (getTimerCount 1); (6) aggregate did-start-loading classification restored -> an overlapping subframe navigation recloses the gate after the handshake (ready false until watchdog) — deterministically red; (7) handshake-while-open reconcile removed -> a pty:rendererDispatcherReady arriving after a missed lifecycle edge leaves the gate pinned (rendererInFlightChars stays 524288, pending 90112, rendererLifecycleResetCount 0) — locally verified red; (8) cross-registration bridge cancel removed (top-of-registerPtyHandlers clearRendererDispatcherReadyWatchdog) -> a prior registration's armed watchdog survives re-registration as an orphaned timer (getTimerCount 1 instead of 0) — locally verified red. With the full fix all eight are green. The performance budget below still holds: the watchdog is a single unref'd one-shot per reset, not per-chunk. Needs a saved CI or intentional-break artifact before blocking promotion."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The reset is an O(#ptys) map clear on rare lifecycle events (reload/crash) plus one unref'd one-shot ~10s watchdog timer per reset (cancelled by the handshake or a re-registration); no polling and no per-chunk work. Any PR changing the delivery gate, in-flight accounting, or flush loop must re-measure terminal throughput before promotion."
      },
      "promotionCriteria": [
        "Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach saved red/green evidence from removing the lifecycle-reset accounting clear.",
        "Add an Electron-level reload survival test that proves a saturated pane resumes rendering and input after Cmd+R / crash recovery."
      ],
      "knownGaps": [
        "Audit3077 retires the renderer once-per-page dispatcher-ready request example. It called ensurePtyDispatcher twice, without proving two attach calls or handshake ordering. Main-side lifecycle/hold/watchdog evidence and the desired invariant retain their original scope.",
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The unit oracle drives a local mock PTY; daemon and WSL coverage rides the same pipeline but has no dedicated provider-contract test yet.",
        "The dev repro covers the output-delivery freeze only; the arrow-key input symptom and mouse-mode flood observed in the same incident are out of scope and need their own repros.",
        "No live Electron reload-survival assertion yet — the gate proves the main-side accounting reset, not the full renderer reattach paint."
      ],
      "demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
    },
    {
      "id": "runtime-events.renderer-subscription-ownership",
      "title": "Runtime events stay owned by their renderer subscription",
      "maturity": "experimental",
      "protection": "none",
      "owner": "runtime-platform",
      "layer": "ipc-contract",
      "surfaces": [
        "renderer runtime events",
        "remote runtime reconnect replay",
        "renderer Linear refresh"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "NEXT136 retired affected callbacks and complete execution receipts. No equivalent fresh execution, provider/platform scope, soak or measured-budget credit is claimed. Audit2233 removes synthetic payload inventories, profile/notification forwarding and the extra cleanup replay/call-count case from runtime-client-ipc-bridge-ownership. Historical dated receipts remain unchanged and do not validate this reduction. No equivalent replay/re-subscription alarm or fresh runtime/platform/provider evidence is claimed. Retired assertion reference verbatim: \"does no replay recovery or resubscription after cleanup\"",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/hooks/runtime-client-events-sync.ts"
      ],
      "invariant": "Only the current subscription attempt can cause renderer event work or reconnect recovery. Current early frames and other hosts survive; canceled late setup handles dispose.",
      "oracle": "No current executed oracle remains after the authorized source-case and receipt retirements.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "knownGaps": [
        "No native Windows/Linux/WSL, live SSH/remote or rendered app lifecycle test.",
        "Already-admitted asynchronous handlers are not canceled; physical listener cleanup still waits for setup settlement.",
        "No CI soak or mounted render/network/heap measurement.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims."
      ],
      "promotionCriteria": [
        "Retain actual composed dispatch/publication and late-disposal oracles; add CI soak and cross-platform lifecycle evidence before promotion."
      ],
      "demotionRule": "Keep experimental until soak; investigate failures without suppressing ownership assertions or unexplained retries."
    },
    {
      "id": "runtime-files.watcher-process-isolation",
      "title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "process-rpc-contract",
      "surfaces": [
        "headless orca serve",
        "paired file explorer",
        "runtime editor external-change detection",
        "desktop filesystem watcher",
        "SSH relay filesystem watcher and live PTYs"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime", "ssh"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": ["local", "remote-runtime", "ssh"],
      "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n          \"assertions\": [\n            \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n            \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n            \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n          ]\n        } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result. This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/5308",
        "https://github.com/stablyai/orca/issues/7547",
        "https://github.com/stablyai/orca/issues/8212"
      ],
      "invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
      "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2086 (sources2082/2083): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. Historical prior account (preserved verbatim): Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. Historical prior account (preserved verbatim): Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n          \"assertions\": [\n            \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n            \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n            \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n          ]\n        } Historical prior account (preserved verbatim): Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1683 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
        "pnpm run build:electron-vite",
        "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
        "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
        "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
        "pnpm exec vitest run --config config/vitest.config.ts"
      ],
      "testFiles": [
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts",
        "src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts",
        "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts",
        "src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts",
        "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts",
        "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts",
        "src/main/ipc/filesystem/watcher-process/event-delivery/parcel-watcher-event-delivery.test.ts",
        "src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts",
        "src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts",
        "src/main/ipc/worktrees-delete-pty-teardown.test.ts",
        "src/main/ipc/worktrees-orphan-directory-cleanup.test.ts",
        "src/main/ipc/worktrees-remove-preflight.test.ts",
        "src/main/workspaces/removal/watcher-removal-gate.test.ts",
        "src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts",
        "src/main/providers/local-pty/local-pty-provider-shutdown.test.ts",
        "src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts",
        "src/main/daemon/sessions/testing/session.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host.test.ts",
        "src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts",
        "src/main/runtime/files/watch/orca-runtime-files-watch.test.ts",
        "src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
        "src/main/runtime/construction/orca-runtime.test.ts",
        "src/main/runtime/rpc/methods/files/files.test.ts",
        "src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts",
        "src/renderer/src/web/web-runtime-client.test.ts",
        "src/shared/cross-platform-path.test.ts",
        "src/shared/physical-exit-tracker.test.ts",
        "src/shared/promise-settlement-waiters.test.ts",
        "config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
        "config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs"
      ],
      "assertionRefs": [
        {
          "file": "src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts",
          "assertions": [
            "pins Parcel to the Windows backend for local Windows watches; rejects installs during destructive removal and allows a retry afterward; never watches an SSH path on the local disk"
          ]
        },
        {
          "file": "src/main/ipc/filesystem/watcher-process/child-lifecycle/parcel-watcher-child-registry.test.ts",
          "assertions": [
            "capacity notification closes the release-before-listen race and serializes reserving waiters per released slot"
          ]
        },
        {
          "file": "src/shared/physical-exit-tracker.test.ts",
          "assertions": [
            "timed-out physical-exit waiters detach while active and later retries still settle on exact exit"
          ]
        },
        {
          "file": "src/shared/promise-settlement-waiters.test.ts",
          "assertions": [
            "an actual timed-out waiter rejects while a remaining waiter resolves and pending timers are cleared on settlement",
            "an already-aborted caller rejects and invokes its ownership-abandon callback"
          ]
        },
        {
          "file": "src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts",
          "assertions": [
            "initial-subscribe crashes complete with an interruption refresh",
            "watch errors before readiness reject setup and physically cancel the native crawl",
            "watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
            "IPC disconnect recovery restores every existing root before accepting new setup",
            "queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
            "queues subscribe and unsubscribe behind the retiring child; bounds a pending crawl and restores healthy roots after setup timeout",
            "production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
            "missing built entries fail closed"
          ]
        },
        {
          "file": "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-supervisor-capacity.test.ts",
          "assertions": [
            "a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
          ]
        },
        {
          "file": "src/main/ipc/filesystem/watcher-process/supervision/parcel-watcher-disconnect-termination.test.ts",
          "assertions": [
            "pending-crawl cancellation after disconnect remains pending until the exact child exits",
            "ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
            "a cancellation deadline joins active disconnect termination without duplicate sibling resubscription",
            "an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
          ]
        },
        {
          "file": "src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts",
          "assertions": [
            "worktree deletion physically aborts pending native setup and settles before its crawl resolves",
            "a cancelled pending install retains physical-exit failure across an immediate second destructive close",
            "desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly",
            "Windows event payloads retain the physical root spelling instead of the comparison key",
            "failed local worktree removal restores every live renderer listener and emits overflow"
          ]
        },
        {
          "file": "src/main/runtime/files/watch/orca-runtime-files-watch.test.ts",
          "assertions": [
            "Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners"
          ]
        },
        {
          "file": "src/main/runtime/workspaces/removal/worktree-teardown.test.ts",
          "assertions": [
            "overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise",
            "destructive teardown rejects instead of releasing deletion when physical stop misses its deadline",
            "cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership",
            "remote provider enumeration matches authoritative worktree ownership without touching the local-only registry"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/files/files.test.ts",
          "assertions": [
            "terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
          ]
        },
        {
          "file": "src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts",
          "assertions": [
            "the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events"
          ]
        },
        {
          "file": "src/shared/cross-platform-path.test.ts",
          "assertions": [
            "POSIX literal backslashes preserve containment and relative identity",
            "Windows drive and UNC roots enforce containment",
            "WSL Linux-tail comparisons remain case-sensitive and relative suffix bytes remain exact"
          ]
        },
        {
          "file": "src/renderer/src/web/web-runtime-client.test.ts",
          "assertions": [
            "a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch"
          ]
        },
        {
          "file": "config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
          "assertions": [
            "five healthy roots share one exact watcher PID within the per-child RSS budget",
            "four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap",
            "CPU and RSS are sampled for every exact child PID and every PID exits during cleanup",
            "per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use"
          ]
        },
        {
          "file": "config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "assertions": [
            "the built watcher entry delivers an event before fault injection",
            "the harness parent survives watcher-child SIGSEGV",
            "the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
          "result": "passed",
          "durationSeconds": 0.58,
          "summary": "Five healthy roots shared one child at 50,688 KiB RSS and 4.9% sampled CPU; four quarantine children totaled 202,368 KiB RSS and 29.5% sampled CPU, all budgets and the eight-child cap passed, and exact-PID cleanup was true."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
          "result": "passed",
          "durationSeconds": 0.56,
          "summary": "Five healthy roots shared one child at 50,176 KiB RSS and 6.0% sampled CPU; four quarantine children totaled 200,112 KiB RSS and 18.0% sampled CPU. The global eight-child cap and all per-child/aggregate budgets passed, and exact-PID cleanup was true."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run build:electron-vite",
          "result": "passed",
          "durationSeconds": 24.41,
          "summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 0.1,
          "summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 0.46,
          "summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
          "result": "passed",
          "durationSeconds": 0.56,
          "summary": "Five healthy roots shared one child at 50,096 KiB RSS and 3.4% sampled CPU; four quarantine children totaled 200,576 KiB RSS and 25.0% sampled CPU. The eight-child physical cap and every per-child/aggregate CPU and RSS budget passed, and exact-PID cleanup was true."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "pnpm run build:electron-vite",
          "result": "passed",
          "durationSeconds": 24,
          "summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 0.01,
          "summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 0.46,
          "summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
        },
        {
          "date": "2026-07-13",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs",
          "result": "passed",
          "durationSeconds": 0.55,
          "summary": "Five healthy roots shared one child at 50,160 KiB RSS and 5.6% sampled CPU; four quarantine children totaled 199,968 KiB RSS and 16.7% sampled CPU, hard per-child and aggregate RSS/CPU budgets passed, the eight-child reservation cap rejected the next launch, and every exact PID exited during cleanup."
        },
        {
          "date": "2026-07-12",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 5,
          "summary": "All 26 built-entry SIGSEGV injections preserved the parent, replaced and resubscribed the child, and delivered a post-crash event; watcher-canary temp-directory count remained 6 before and after the final five-run leak check."
        },
        {
          "date": "2026-07-11",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 0.3,
          "summary": "The source-bundled real supervisor delivered through the built child before and after SIGSEGV; the parent survived and automatic resubscription used a replacement PID."
        },
        {
          "date": "2026-07-11",
          "runner": "local",
          "platform": "macos",
          "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
          "currentCommand": "node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs",
          "result": "passed",
          "durationSeconds": 2.2,
          "summary": "Ten consecutive invocations survived, automatically replaced and resubscribed the child, and delivered a post-crash event. The watcher-canary temp-directory count remained 8 before and after the loop."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "focused process/RPC contract tests plus built child fault harness"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "New deterministic unit coverage and ten consecutive local built-entry harness passes; still below the CI and soak history required for promotion."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2056 retires the exact deleted-source assertion alarms recorded in knownGaps; prior changed-source red/green claims are historical. Unrelated retained-source evidence keeps its original scope. Historical prior account (preserved verbatim): Red tests reproduced the reviewed failures: IPC disconnect-before-exit orphaned existing roots, queue-admission deadlines cascaded shard replacement, a fused shard created one child per root, a standard SSH repository created three healthy watcher supervisors, destructive desktop cleanup waited indefinitely for native setup, and synchronous renderer retry joined a terminal stream. Earlier red coverage also reproduced missing-entry fail-open, terminal recovery loss, stale same-root lease deletion, and unbounded per-child stat lanes. The bounded quarantine and cancellation rewrite passes those contracts, the relay-specific healthy width test reduces the three-root case to one supervisor, and the real-supervisor built-entry harness survives SIGSEGV with automatic replacement. CI/soak history is still absent."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The committed resource probe reproducibly measures five healthy roots sharing one child (50,160 KiB RSS, 5.6% sampled CPU) and four quarantine children (199,968 KiB total RSS, 16.7% sampled CPU), enforces 128 MiB/50% per-child and 512 MiB/100% quarantine aggregate budgets, derives a 1 GiB/400% ceiling across the global eight-physical-child cap, and waits for every exact PID during cleanup. A relay policy test separately proves a standard SSH repository's three roots share one healthy child. Shared pending setup attaches one base-promise reaction per generation; quantitative owner tests abort 10,000 callers at each affected layer and require exactly one anchor, then zero explicit waiters after settlement. The shared supervisor capacity barrier is event-driven, one-shot, abortable, and serialized per released physical slot, waking every same-child desktop, paired-runtime, or SSH relay root without consuming crash-recovery attempts; direct WSL capacity retains the same event-driven desktop retry. Relay PTY admission adds at most two deduplicated path checks per spawn/revive and releases both without polling or retained listeners, while dead-PID reaping settles an existing tracker without allocating another timer. Fault quarantine distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most eight healthy or 32 quarantined operations), each subscription retains at most one active plus one bounded pending batch, and no additional polling or serve-process stat fanout is added."
      },
      "promotionCriteria": [
        "Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
        "Add an eight-root/six-writer event-loop-delay soak artifact with an explicit latency budget.",
        "Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
      ],
      "knownGaps": [
        "Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations  / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit1683 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1645 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1627 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
        "The committed resource probe covers the one-child healthy pool, four-child fault-quarantine ceiling, RSS/CPU sampling, global physical-child cap, and exact-PID cleanup, but sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
        "Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
        "Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected.",
        "Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":11.98,\"summary\":\"Thirty-nine watcher, cancellation, desktop/serve, paired-web, WSL, SSH/relay, removal, and PTY physical-exit files passed with 2,008 tests. Capacity, quarantine, runtime-root, relay, and SSH setup layers each prove that 10,000 aborted callers detach while one anchor remains and zero waiters remain after settlement.\"}",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":11.59,\"summary\":\"Thirty-four watcher, cancellation, desktop/serve, paired-web, WSL, removal, PTY physical-exit, provider, renderer, and path files passed with 1,999 tests; paired-web cancellation now owns a server token before ready and aborts pending setup without a late native install.\"}",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":10.01,\"summary\":\"Twenty-seven watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,886 tests. The suite includes nested removal fencing, renderer/runtime cwd-only admission, legacy provider rows, rejected kill retries, transient WSL capacity, and synchronous-startup reservation cleanup.\"}",
        "Historical receipt before test removal; complete original commands/results/counts preserved without assigning them to remaining tests: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":9.12,\"summary\":\"Twenty-five watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,762 tests. The suite covers operations joining in-flight termination, kill failures retaining ownership, bounded timeouts, atomic relay spawn/revive caps, and PTY-removal admission.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":9.03,\"summary\":\"Twenty-three watcher, desktop/serve removal, terminal-spawn gate, daemon/SSH physical PTY exit, provider ownership, RPC, renderer, and cross-platform path files passed with 1,630 tests. The suite includes same-turn watcher replacement, authoritative SSH teardown before Git, bounded kill-without-exit failures that retain ownership, and local/SSH deletion fail-closed behavior.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts\",\"result\":\"passed\",\"durationSeconds\":8.85,\"summary\":\"18 focused supervisor, disconnect termination, pool, child-entry, delivery, desktop/WSL cleanup and IPC removal, removal-gate, runtime-host/commands and physical PTY teardown, RPC, SSH ownership, renderer/paired-web clients, and cross-platform path files passed with 1,193 tests.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":30.19,\"summary\":\"Test Files  38 passed (38); Tests  2018 passed | 4 skipped (2022). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":30.2,\"summary\":\"Test Files  35 passed (35); Tests  2009 passed | 4 skipped (2013). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":27.78,\"summary\":\"Test Files  28 passed (28); Tests  1944 passed | 4 skipped (1948). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":29,\"summary\":\"Test Files  27 passed (27); Tests  1941 passed | 4 skipped (1945). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":29.2,\"summary\":\"Test Files  26 passed (26); Tests  1924 passed | 3 skipped (1927). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":27.48,\"summary\":\"Test Files  24 passed (24); Tests  1839 passed | 3 skipped (1842). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts\",\"result\":\"passed\",\"durationSeconds\":26.75,\"summary\":\"Test Files  20 passed (20); Tests  1764 passed | 3 skipped (1767). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit\",\"runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped\",\"SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal\",\"a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement\",\"failed CLI worktree deletion restores watcher ownership after releasing the install fence\",\"cross-layer teardown failure joins every bounded watcher close before restoration begins\"]}]",
        "Audit1412: src/main/workspaces/removal/watcher-removal-gate.test.ts reduced. Loses exact removal-error compatibility with renderer predicate under shared message constants. Kept public refusal outcomes do not establish that renderer classification. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/workspaces/removal/watcher-removal-gate.test.ts\",\"assertions\":[\"Windows-equivalent spellings share one removal fence while distinct POSIX backslash roots do not\",\"desktop and runtime removal entry points cannot own overlapping destructive roots concurrently\",\"parent removal waits descendant terminal spawns and rejects later descendant installs\"]}]",
        "Historical receipt before audit1516 package-contract suite removal; original selectors/counts/results are preserved without applying them to the shortened selector: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/desktop-distribution/runtime-verification/package-electron-runtime-contract.test.mjs\",\"result\":\"passed\",\"durationSeconds\":10.01,\"summary\":\"Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests.\"}",
        "Historical receipt before audit1516 package-contract suite removal; original selectors/counts/results are preserved without applying them to the shortened selector: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/desktop-distribution/runtime-verification/package-electron-runtime-contract.test.mjs\",\"result\":\"passed\",\"durationSeconds\":10.69,\"summary\":\"Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests, including watcher/PTY removal fencing and recursive deletion failure behavior.\"}",
        "Historical receipt before audit1516 package-contract suite removal; original selectors/counts/results are preserved without applying them to the shortened selector: {\"date\":\"2026-07-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/managed-server/install/remote-versioned-install.test.ts config/scripts/desktop-distribution/runtime-verification/package-electron-runtime-contract.test.mjs\",\"result\":\"passed\",\"durationSeconds\":9.79,\"summary\":\"Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 225 tests, including terminal removal notification and recursive deletion fencing.\"}",
        "Audit1516 removes package-electron-runtime-contract.test.mjs, a copied release-workflow platform and marker matrix. Its workflow wiring alarm is intentionally retired; no actual packaged watcher delivery was exercised and no equivalent replacement is claimed. Unaffected dated execution receipts retain their original scope; changed optional selectors have no fresh full-gate execution result.",
        "Audit1863 removes the 10,000-caller capacity-wait suite and direct cancel/once callback counts, injected launcher-capacity examples, the Vitest-only reusable-pool example, optional-canary and PID mock inventories, exact metadata-stat concurrency counts, and standalone app-shutdown/case-normalized cleanup examples. Those direct alarms are intentionally lost without equivalent replacement claims; active assertion references and the deleted-file selector are narrowed accordingly. Existing physical resource/fault receipts and historical records retain their original commands, results and counts. Focused surviving helpers do not validate the complete watcher selector, heap/CPU budgets, physical platform matrix or resource guarantees.",
        "Audit1862 removes the bulk 10,000-aborted-caller PromiseSettlementWaiters fixture and its then-attachment/waiter-count accounting. The direct one-shared-reaction and immediate cancelled-closure detachment alarms are intentionally lost; no heap or latency measurement was established and no equivalent replacement is claimed. Retained cases exercise abort scheduling, timeout settlement/timer clearance, and already-aborted ownership callback only. Focused survivor execution does not validate the full watcher selector or physical watcher/resource claims. Historical commands/results/counts remain historical.",
        "Audit1925 (sources1922/1923): Partial runtime watcher-host suite loses mocked option/event/overflow/resubscription forwarding, supplied teardown-error propagation, aborted-signal/no-call and private ten-thousand-waiter-count inventories. Retire the 10,000-caller bound and failed-recovery-subscriber-ending assertion aliases. Keep same-root owner cancellation, pre-ready replacement, held root-close join, stale-generation recovery delivery and initial failed-root ownership mappings backed by retained real-host callbacks with injected subscription/error/physical-exit promises. No actual native watcher, process termination or resource bound was observed. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'installs a bounded watch in the shared runtime watcher process'; 'maps child-enriched watcher events without host-process stat work'; 'turns child overflow and recoverable watcher errors into a conservative refresh'; \"refreshes on the child's resubscription notification\"; 'waits for recovery-generation cancellation before releasing the root'; 'propagates recovery-generation physical termination failure'; 'ends subscribers only after isolated recovery also fails'; 'cancels a pending physical watch when its only client aborts'; 'removes ten thousand cancelled root callers while one anchor remains'; 'shares one native subscription per root across same-root callers'; 'stops forwarding events after the last subscriber disposes'; 'propagates an initial watcher process subscription failure'; 'does not retry a root-specific initial subscription failure'.",
        "Audit1925 historical original assertion object, preserved verbatim; removed aliases are retired, any surviving aliases remain limited to unchanged retained callbacks:\n{\n          \"file\": \"src/main/runtime/file-watcher-host.test.ts\",\n          \"assertions\": [\n            \"same-root clients share one physical watch and one client abort cannot cancel another owner's setup\",\n            \"concurrent pre-ready cancellations join one native root release before an immediate replacement subscribes\",\n            \"10,000 cancelled runtime-root callers detach while one setup anchor remains\",\n            \"root-scoped destructive cleanup joins an in-progress subscriber teardown\",\n            \"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events\",\n            \"only failed isolated recovery ends subscribers, after a conservative overflow\",\n            \"initial setup failure remains discoverable by root-scoped destructive cleanup until physical exit\"\n          ]\n        }",
        "Audit1931 (sources1928/1929): Partial runtime files-watch suite retains controlled Windows close-event waiting, shared-client survival, late physical-exit ownership/deadline cleanup and shutdown joining. Its combined Windows close/deadline/late-exit alias remains backed by unchanged callbacks. Retire native-error-close, pre-publication setup ownership and failed-delete rearm aliases; associated delegation, failure forwarding, removal routing and recovery examples are lost. These tests inject watch/subscription seams and do not observe an actual native watcher or physical process. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'uses a conservative Node watcher for Windows runtime file watches'; 'treats a Windows watcher error before cleanup as physical close'; 'closes Windows removal watchers without reauthorizing a path Git already unregistered'; 'retries a failed Windows watcher close before allowing deletion'; 'delegates local recursive watching to the watcher process'; 'propagates a watcher process failure to the caller'; 'retains pre-publication watcher setup ownership through destructive cleanup'; 'rejects a runtime watch throughout destructive removal'; 'awaits root-scoped runtime watcher teardown for deletion'; 're-arms a logical runtime watch after removal aborts'; 're-arms a logical runtime watch after a timed-out child physically exits'; 'does not re-arm a stopped runtime watch after a timed-out child exits'; 'clears a failed runtime release after physical child exit'.",
        "Audit1931 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orca-runtime-files-watch.test.ts\",\n          \"assertions\": [\n            \"Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners\",\n            \"a Windows watcher error before cleanup uses Node's proven native error-close as physical-exit proof, emits final overflow and terminal error, and releases deletion ownership\",\n            \"pre-publication local runtime setup failure remains owned through destructive cleanup\",\n            \"failed deletion re-arms runtime watches immediately after ordinary teardown or after delayed physical exit, without reviving a logically stopped watch\"\n          ]\n        }",
        "Audit1973: Delete the standalone mocked watcher cleanup suite and its entire sole-file prospective command. Retire the removed file-command transport-abort alias; preserve the independent cancellation suite and final-overflow/error/end cleanup callback, and13 unrelated receipt objects. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1973 historical original commands object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files/files-watch-cleanup.test.ts --reporter=dot\"",
        "Audit1973 historical original testFiles object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n\"src/main/runtime/rpc/methods/files/files-watch-cleanup.test.ts\"",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/files/files-watch-cleanup.test.ts\",\n          \"assertions\": [\n            \"a failed paired-web unwatch retries after already-resolved or late physical exit and emits stream end exactly once\"\n          ]\n        }",
        "Audit1973 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/rpc/methods/files/files.test.ts\",\n          \"assertions\": [\n            \"pre-ready transport abort reaches RuntimeFileCommands as the owning AbortSignal\",\n            \"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts: delivers remote file changes to listeners for the same worktree. src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Exact retired assertionRefs, preserved as historical objects only: {\n          \"file\": \"src/renderer/src/runtime/files/watching/runtime-file-client-watch.test.ts\",\n          \"assertions\": [\n            \"terminal watcher error and setup failure evict the shared entry before retrying callbacks run\",\n            \"an old stream end cannot evict the replacement stream, which still delivers to its listener\",\n            \"two same-worktree listeners share a synthetic subscription until the final stop unsubscribes and sends unwatch\"\n          ]\n        }",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "D01 final candidate whole-registration policy removes retired module selectors and obsolete assertion descriptions prospectively. Existing unaffected receipts retain their original scope; reduced selectors have no new execution or equivalent replacement claim. Retired named modules: [\"src/main/runtime/files/watch/file-watcher-host.test.ts\"]. Retired compound assertion refs, preserved as historical data: []",
        "Audit2377/2381 removes bundled-skill eligibility5 silent late-writer successful backup, layouts1 global forced backup, legacy-auto-update2 old release plus extra notes, and native-discovery7/13/18/19/21 OpenCode project, Pi home symlink, default Hermes root, requested-cwd agents symlink and standalone SSH-builder paired cwd checks. Lose those exact backupPath/bytes/global-link-lock/history/provider/label/path combinations and localized SSH-builder sample. Retained common owners are not identical replacements; no fresh validation is claimed for this reduced broad command.",
        "Audit2383 removes the complete antigravity-skill-discovery.test.ts suite. Lose the exact .gemini/config/skills path, home-antigravity source, antigravity owner, existence and contributing-root observation. Other providers exercise common discovery dispatch, not this exact catalogue row. No equivalent replacement or fresh validation of the reduced broad command is claimed.",
        "Audit2385 removes finder regular-depth and direct missing-root examples, the three-row staging-name matrix, and an initial unknown WSL-list record sample. Lose those isolated fixtures, exact backup name spellings and malformed prefix sequence; retained actual owners are not identical replacements. Missing-root case did not model disappearance after the production caller existence check. No fresh validation of this reduced broad command is claimed.",
        "Audit2389 removes whole skill-install-preview.test.ts plus destinations1 and recovery2. Lose missing-preview name/state/global identity/fixed codex+claude inventory, exact plain-global host identity return, and already-published receipt finalization fixture. No nonmutation assertion existed in preview; retained real home delivery and placed-canonical recovery are not identical complete replacements. No fresh validation is claimed.",
        "Audit2393 refresh2401 removes skill-installation original1 and only the original receiptless request case. Lose uninterrupted first-install status/exact placement count and public canonical receiptless conflict/unowned routing. Retain upstream request ownership tests and lower transaction interruption coverage byte-exact. Deleted guard case had no directory/content preservation assertion. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2397 review amendment removes whole empty-gzip, WSL provider error-mapping and remote-cancellation registry suites; two initial hostname-suffix/userinfo URL rows and initial-expired grant sample; linked-parent alias classification. Lose no-input custom gzip branch, WSL failure labels, basic registry lifecycle/duplicate-ID guard, exact hostname-suffix/userinfo input variants, prefetch expired-grant no-network and preexisting alias result alarms. Preserve the single initial wrong-port origin authorization case, original abort-after-begin cleanup/no-signal cancelUpload dispatch suite and original independent-copy modified-digest removable=false case. No equivalent complete replacement or fresh validation claimed for the remaining losses.",
        "Audit2404 removes whole skill-share-package-name.test.ts, skill-delete-plan original1/6 skill-delete-recovery original2 and skill-share-preparation original2. Lose lookup503 rejection/status propagation through prepare, explicit unblocked unordered alias-kind/canonical sample with cwd undefined, stale classification after +60000ms actual mtime change, successful first-pass single-move rollback/staged-path absence and prior-process preparation-root archive directory cleanup. Retained exact identities use cwd home; public stale guard submits timestamp1; recovery retry cases are not identical first-pass fixtures. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2412 removes whole useVirtualizedScrollAnchor.marks-restore-signal.test.ts (six fake-hook geometry/mark/convergence/user-takeover/clamp alarms), use-task-creation-draft-retention original3/4 (immediate discard mock-call count/unopened no-write), use-terminal-bulk-close-actions.placement original6/7 (absent new-agent append and one real history-publication count at consumed3/30 scale), PendingNativeChatCreation original6 (unmounted abort completion/timer cleanup), and wsl-move-dialog-store original1/9/13 (default whole-distro count/reference/reuse and rejected-preview/start refusal recovery). The history counter measures genuine publication work without entries/order/reopen assertions; its unique batching alarm is intentionally retired. Fake React scroll tests ignore dependency scheduling and cleanup; unique simulated arithmetic alarms are deliberately lost. Retained existing-terminal reorder is not new-agent append coverage; mounted handoff timeout is not abort coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2417 removes commit-actions-real-git original3/4 (ordinary clean cherry-pick and revert content, subject and current-branch samples), and pty-startup-ingress-exited-asker original8/12 (actual foreground-group read budget across100queued queries, and zero foreground reads across100normal chunks plus final emitted/accepted raw cursor equality). Counters measure actual callback work and scale is consumed; these internal-work alarms are deliberately retired. Retained unborn, conflict and sequencer cases are not equivalent ordinary-success coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2425 removes use-workspace-copy-status original5, which returns a fixture-supplied readError string through statusReadError. No consumer blocker or attempted branch switch established refusal; the unique error-forwarding sample is intentionally retired. Other copy ownership and stale-refresh cases are not equivalent error-path coverage. No equivalent replacement or fresh validation is claimed.",
        "Audit2432 removes BranchPicker.test.tsx original3, which only asserted onOpenChange(true/false) with an always-mounted mocked Popover. It never reopened the picker or consumed the callback in the parent status-refresh owner, despite its title. Lose that unique open/close notification alarm. Retained blocker/collision recovery and asynchronous post-unmount outcome cases are not equivalent replacement coverage. No fresh validation of the reduced selector is claimed.",
        "Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed.",
        "Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed.",
        "Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed.",
        "Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed.",
        "Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation.",
        "Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed.",
        "Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked.",
        "Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed.",
        "Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms.",
        "Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery.",
        "Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction.",
        "Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed.",
        "Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed.",
        "Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed.",
        "Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed.",
        "Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed.",
        "Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired.",
        "Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands.",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical.",
        "Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed.",
        "Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed.",
        "Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed.",
        "Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope.",
        "Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope.",
        "Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope.",
        "Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts --reporter=dot\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/sessions/testing/session.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/daemon/terminal-host/testing/terminal-host.test.ts src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/files/watch/orca-runtime-files-watch.test.ts src/main/runtime/workspaces/removal/worktree-teardown.test.ts src/main/runtime/construction/orca-runtime.test.ts src/main/runtime/rpc/methods/files/files.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts\",\n        \"pnpm run build:electron-vite\",\n        \"node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs\",\n        \"node config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs\",\n        \"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs\",\n        \"pnpm exec vitest run --config config/vitest.config.ts\"\n      ]\ntestFiles: [\n        \"src/main/daemon/providers/adapter/testing/daemon-pty-adapter.test.ts\",\n        \"src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts\",\n        \"src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-child-launch.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts\",\n        \"src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts\",\n        \"src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts\",\n        \"src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts\",\n        \"src/main/ipc/worktrees-delete-pty-teardown.test.ts\",\n        \"src/main/ipc/worktrees-orphan-directory-cleanup.test.ts\",\n        \"src/main/ipc/worktrees-remove-preflight.test.ts\",\n        \"src/main/workspaces/removal/watcher-removal-gate.test.ts\",\n        \"src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts\",\n        \"src/main/providers/local-pty/local-pty-provider-shutdown.test.ts\",\n        \"src/main/daemon/pty-subprocess/testing/pty-subprocess.test.ts\",\n        \"src/main/daemon/sessions/testing/session.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host.test.ts\",\n        \"src/main/daemon/terminal-host/testing/terminal-host-session-reaping-leak.test.ts\",\n        \"src/main/runtime/files/watch/orca-runtime-files-watch.test.ts\",\n        \"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\n        \"src/main/runtime/construction/orca-runtime.test.ts\",\n        \"src/main/runtime/rpc/methods/files/files.test.ts\",\n        \"src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts\",\n        \"src/renderer/src/web/web-runtime-client.test.ts\",\n        \"src/shared/cross-platform-path.test.ts\",\n        \"src/shared/physical-exit-tracker.test.ts\",\n        \"src/shared/promise-settlement-waiters.test.ts\",\n        \"config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs\",\n        \"config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/ipc/filesystem/watchers/filesystem-watcher.test.ts\",\n          \"assertions\": [\n            \"a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait\",\n            \"failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watchers/filesystem-watcher-native-capacity.test.ts\",\n          \"assertions\": [\n            \"typed native child-capacity exhaustion automatically retries after a serialized slot release\",\n            \"renderer unwatch cancels a pending native capacity retry before subscription restarts\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/parcel-watcher-child-registry.test.ts\",\n          \"assertions\": [\n            \"capacity notification closes the release-before-listen race and serializes reserving waiters per released slot\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/physical-exit-tracker.test.ts\",\n          \"assertions\": [\n            \"timed-out physical-exit waiters detach while active and later retries still settle on exact exit\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/promise-settlement-waiters.test.ts\",\n          \"assertions\": [\n            \"an actual timed-out waiter rejects while a remaining waiter resolves and pending timers are cleared on settlement\",\n            \"an already-aborted caller rejects and invokes its ownership-abandon callback\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts\",\n          \"assertions\": [\n            \"initial-subscribe crashes complete with an interruption refresh\",\n            \"watch errors before readiness reject setup and physically cancel the native crawl\",\n            \"watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root\",\n            \"IPC disconnect recovery restores every existing root before accepting new setup\",\n            \"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard\",\n            \"a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline\",\n            \"a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline\",\n            \"production runtime-pool disposal rejects later subscriptions without forking an overlapping child\",\n            \"missing built entries fail closed\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts\",\n          \"assertions\": [\n            \"a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit\",\n            \"an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/parcel-watcher-supervisor-capacity.test.ts\",\n          \"assertions\": [\n            \"one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier\",\n            \"a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts\",\n          \"assertions\": [\n            \"pending-crawl cancellation after disconnect remains pending until the exact child exits\",\n            \"ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains\",\n            \"a cancellation deadline joins active disconnect termination without duplicate sibling resubscription\",\n            \"an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watcher-process/runtime-watcher-pending-assignment.test.ts\",\n          \"assertions\": [\n            \"10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant\",\n            \"an already-aborted first caller synchronously releases pending assignment ownership\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts\",\n          \"assertions\": [\n            \"worktree deletion physically aborts pending native setup and settles before its crawl resolves\",\n            \"a cancelled pending install retains physical-exit failure across an immediate second destructive close\",\n            \"desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly\",\n            \"Windows event payloads retain the physical root spelling instead of the comparison key\",\n            \"failed local worktree removal restores every live renderer listener and emits overflow\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/files/watch/orca-runtime-files-watch.test.ts\",\n          \"assertions\": [\n            \"Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/workspaces/removal/worktree-teardown.test.ts\",\n          \"assertions\": [\n            \"overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise\",\n            \"destructive teardown rejects instead of releasing deletion when physical stop misses its deadline\",\n            \"cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership\",\n            \"remote provider enumeration matches authoritative worktree ownership without touching the local-only registry\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/files/files.test.ts\",\n          \"assertions\": [\n            \"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/files/files-watch-cancellation.test.ts\",\n          \"assertions\": [\n            \"the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/cross-platform-path.test.ts\",\n          \"assertions\": [\n            \"POSIX literal backslashes preserve containment and relative identity\",\n            \"Windows drive and UNC roots enforce containment\",\n            \"WSL Linux-tail comparisons remain case-sensitive and relative suffix bytes remain exact\"\n          ]\n        },\n        {\n          \"file\": \"src/renderer/src/web/web-runtime-client.test.ts\",\n          \"assertions\": [\n            \"a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch\"\n          ]\n        },\n        {\n          \"file\": \"config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-resource-probe.mjs\",\n          \"assertions\": [\n            \"five healthy roots share one exact watcher PID within the per-child RSS budget\",\n            \"four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap\",\n            \"CPU and RSS are sampled for every exact child PID and every PID exits during cleanup\",\n            \"per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use\"\n          ]\n        },\n        {\n          \"file\": \"config/scripts/diagnostics/runtime-watchers/runtime-file-watcher-fault-harness.mjs\",\n          \"assertions\": [\n            \"the built watcher entry delivers an event before fault injection\",\n            \"the harness parent survives watcher-child SIGSEGV\",\n            \"the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The retained runtime registration driver loses three complete imported fragments: changed-working-label title facts and suppressed-frame tracked snapshots; refusing SSH GitLab MR-base lookup before local Git/glab calls; and missing folder-workspace path creation/update refusal before spawn/store mutation. These alarms are intentionally lost. Other imported fragments and separately rooted dated receipts are unchanged; they are not equivalent replacement coverage. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  All earlier notes and dated/archived evidence retain original scopes.",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed.  Earlier notes and dated/archived evidence retain original scopes.",
        "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. All prior notes and archived receipts retain original scopes.",
        "Audit3460 final-v2 composes accepted AUTHOR3454/PEER3455 on actual post263 main: intentionally removes99 authored/106 potential expanded cases across16 selected drivers, including7 whole suites, retaining24 authored/26 potential cases. No equivalent replacement or fresh runtime is claimed. Broad root-unit discovery loses whole cross-client workspace-sync, terminal-preview, picker-skill-hint and close-routing suites plus reduced worker-stop, remote-owned-record, scanner, mobile-bundle and daemon-health samples. Separate E2E discovery also loses the paired mobile/desktop mirror journey and two unit drivers. Retained callback/table/outer-loop/guard bytes are exact; retained checks do not replace the removed alarms. No app, native device, mixed-version, remote or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Earlier notes, complete dated receipts and archived gaps retain their original scopes."
      ],
      "demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
    },
    {
      "id": "terminal-input.plugin-explicit-worktree-routing",
      "title": "Plugin terminal input stays inside the freshly resolved worktree",
      "maturity": "experimental",
      "protection": "none",
      "owner": "plugin-platform",
      "layer": "main-relay-contract",
      "surfaces": [
        "plugin host API terminal input",
        "active worktree resolution",
        "provider terminal inventory",
        "relay capability enforcement"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1678 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic macOS contract evidence covers opaque local- and SSH-shaped terminal ids, one bounded worktree listing, mismatch rejection, and the main/relay host-call adapter matrix. It does not launch a live PTY or provision a relay-hosted plugin.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/8549"],
      "invariant": "terminal.sendText accepts only an explicit provider-owned terminal id present in one bounded inventory of the worktree resolved immediately before the send; an absent id causes zero send calls, and relay callers cannot supply their own capability grants or transport classification.",
      "oracle": "Audit1678 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Resolve the active worktree once, list that worktree with the v0 terminal cap once, and assert zero sendTerminal calls for a mismatched opaque id versus exactly one send for matching local- and SSH-shaped ids; then run the same permission and schema cases through desktop-main and registered relay panel/worker adapters and compare error codes.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 10,
        "scope": "plugin host main/relay contract tests"
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "The deterministic focused suite passed locally once and needs CI and soak history before promotion."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Exact mismatch/send counts and adapter error parity are asserted; intentional-break and saved CI evidence are still missing."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Each plugin send resolves once, performs exactly one list capped at 50 terminals, and performs at most one send. The path adds no polling, subprocesses, provider fanout, renderer work, or startup await."
      },
      "promotionCriteria": [
        "Run for at least 100 consecutive passes or 14 days across required CI platforms.",
        "Attach intentional-break evidence for the worktree membership check and relay transport binding.",
        "Exercise live local and SSH provider terminals, including mismatch rejection and successful input echo.",
        "Keep relay-hosted plugin provisioning behind a separate reviewed policy before replacing the fail-closed registration."
      ],
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1678 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Linux and Windows execution evidence is not recorded.",
        "Daemon, WSL, remote-runtime, and mobile-relay providers have no live input evidence.",
        "Local and SSH coverage is contract-level over opaque ids, not a live PTY input/echo run.",
        "The bounded 50-terminal inventory intentionally rejects a target not present in the capped result; scale behavior above that cap needs a targeted membership API before expansion.",
        "Relay-hosted plugin provisioning, consent persistence, workers, and audit services remain out of scope and the relay registration therefore denies every provisioned identity by default."
      ],
      "demotionRule": "Keep experimental or demote to protection none if the suite flakes, permits a mismatched terminal send, performs more than one inventory list per call, accepts client-supplied grants, or relay and desktop error codes diverge."
    },
    {
      "id": "ssh-port-forward.renderer-snapshot-continuity",
      "title": "SSH forwarded-port state survives stale renderer hydration",
      "maturity": "experimental",
      "protection": "none",
      "owner": "desktop-ssh",
      "layer": "renderer-ssh-snapshot-reconciliation",
      "surfaces": [
        "SSH Ports panel",
        "forwarded-port renderer state",
        "persisted forward restoration",
        "ssh2 port forwarding",
        "system-SSH port forwarding"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["ssh2", "system-ssh"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: A deterministic renderer ordering test covers stale initial snapshots independently by target and stream, including hydration after partial SSH authority reconciliation. Headed macOS Electron tests force the same startup hydration race and use an ephemeral Docker sshd, a real remote Git worktree, real remote Node listeners, real HTTP forwards, in-place relay and full transport reconnect restoration, collision rejection, scan refresh, explicit removal, and an unrelated surviving forward through both transports. The forced-system run requires a recorded OpenSSH -L invocation. Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["user-reported SSH Ports panel disappearance"],
      "invariant": "For one connected SSH authority, a renderer snapshot may update Forwarded or Detected state only if no newer push for that target and stream arrived after the snapshot began. Active tunnels and persisted intent remain authoritative through scan refresh and reconnect until explicit removal or a real connection-lifecycle transition.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Hold empty initial Forwarded and Detected snapshot promises, publish live events, release the snapshots, and require each target and stream to preserve only its own newer push while applying unaffected snapshots. Reject one target's Detected snapshot and require its Forwarded snapshot plus later targets to hydrate independently. Begin another target with partial connected authority and require its snapshots to hydrate after same-watermark authority reconciliation. In headed Electron, hold an authoritative empty Forwarded snapshot across renderer reload, add a forward through the Ports panel, release and confirm the wrapped main handler resumed, then complete a later renderer-to-main listPortForwards round trip as the ordered hydration-continuation barrier. Before checking the Forwarded row, require main inventory, persisted intent, HTTP, remote process identity, and close warnings to prove the tunnel remained authoritative. Then forward two real Docker listeners, refresh detection, force an in-place relay-channel reconnect, perform a full transport reconnect, reject a bound local-port collision, remove one row, and require all signals to agree.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: The deterministic contract and both real transport runs passed locally; CI and soak history are not yet available."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: The identical renderer unit and headed Electron oracles fail on current main because the stale empty hydration reply becomes a second and final Forwarded write, pass with bounded per-target per-stream pending-hydration state, fail again when only that fix is removed, and pass again after restoration. In the tightened headed revert, both transports first proved main inventory, persisted intent, HTTP, remote process identity, no live close warning, and renderer continuation, then failed only at the missing Forwarded-row assertion. Both passed after rebuilding the restored candidate."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: The fix adds one effect-scoped map containing only unresolved target hydrations, one O(1) boolean write per relevant existing push event, and one O(1) authority/stream check per initial snapshot. Forwarded and Detected hydrate independently so a stalled stream does not block its peer or later targets; entries are removed after both settle. It adds no polling, timers, IPC calls, scans, subprocesses, or renderer subscriptions."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Run the headed topology on Linux and Windows with their native system-SSH clients.",
        "Re-run the headed snapshot barrier after Electron major-version upgrades.",
        "Keep the independent Forwarded and Detected freshness assertions and both transport runs green."
      ],
      "knownGaps": [
        "Headed live evidence is macOS-only; Linux and Windows system-SSH clients were not exercised.",
        "The headed race uses Electron's private invoke-handler registry to delay the real listPortForwards handler because Electron exposes no public handler-wrapping API.",
        "The live run reconnects an existing app session but does not restart the packaged application from disk.",
        "The live topology uses an SSH Git worktree; folder-workspace behavior is covered by target-scoped renderer reconciliation rather than a second headed topology.",
        "Audit1400: src/main/ipc/ssh/ssh.test.ts reduced. Lose trivial missing target and mocked publication inventory. Preexisting unresolved ../ssh/ssh-port-scanner mock is recorded, not fixed. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-07-30\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh/ssh.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 6.77,\n          \"summary\": \"Six renderer, main-process, and barrier lifecycle files passed with 215 tests, including deterministic stale-snapshot, rejected-stream, partial-authority, and single-capture isolation plus existing collision, delayed-exit, reconnect, persistence, re-registration, and unrelated-forward contracts.\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"ssh2\",\"system-ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts\",\n    \"assertions\": [\n      \"does not let initial SSH port snapshots overwrite newer push events\"\n    ]\n  },\n  {\n    \"file\": \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n    \"assertions\": [\n      \"lists forwards filtered by connectionId\",\n      \"removes a forward by id\"\n    ]\n  },\n  {\n    \"file\": \"src/main/ssh/system-transport/system-ssh-forward-process.test.ts\",\n    \"assertions\": [\n      \"does not spawn ssh when the requested local forward port is already in use\",\n      \"sends SIGTERM then SIGKILL when the process does not exit\",\n      \"does not resolve stop until the process exits\"\n    ]\n  }\n]",
        "Audit1400 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/main/ipc/ssh/ssh.test.ts\",\n    \"assertions\": [\n      \"preserves active port forwards and live connections across handler re-registration\",\n      \"persists desired forwards and broadcasts when an active forward closes unexpectedly\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts\",\n          \"assertions\": [\"does not let initial SSH port snapshots overwrite newer push events\"]\n        },\n        {\n          \"file\": \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n          \"assertions\": [\"lists forwards filtered by connectionId\", \"removes a forward by id\"]\n        },\n        {\n          \"file\": \"src/main/ssh/system-transport/system-ssh-forward-process.test.ts\",\n          \"assertions\": [\n            \"does not spawn ssh when the requested local forward port is already in use\",\n            \"sends SIGTERM then SIGKILL when the process does not exit\",\n            \"does not resolve stop until the process exits\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ipc/ssh/ssh.test.ts\",\n          \"assertions\": [\n            \"preserves active port forwards and live connections across handler re-registration\",\n            \"persists desired forwards and broadcasts when an active forward closes unexpectedly\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh/ssh.test.ts --reporter=dot\",\"pnpm exec electron-vite build --mode e2e\"],\"testFiles\":[\"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts\",\"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\"src/main/ssh/system-transport/system-ssh-forward-process.test.ts\",\"src/main/ipc/ssh/ssh.test.ts\"]}"
      ],
      "demotionRule": "Keep experimental or demote if same-authority snapshots can overwrite newer pushes, reconnect silently loses persisted intent, one forward operation disturbs unrelated forwards, live HTTP diverges from renderer/main inventory, or either transport topology flakes without an identified product or harness fault."
    },
    {
      "id": "remote-wire.cross-version-terminal-journey",
      "title": "A released client and a current server still complete one terminal journey in both skew directions",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "remote-runtime",
      "layer": "cross-version-protocol-integration",
      "surfaces": [
        "terminal binary stream framing",
        "terminal multiplex subscribe handshake and capability negotiation",
        "host-published snapshot and output projection",
        "remote terminal reconnect"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["paired-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["paired-runtime"],
      "coverageNotes": "Loads the real host RPC methods, real RpcDispatcher, real renderer terminal multiplexer, and codecs from the current working tree, exact pre-fix main, newest release tag, and the pinned reported 1.4.192-client/1.4.191-host commits. In-process transport reproduces production frame routing, including decoder-rejected opcodes. Covers the terminal stream only; session tabs, agent publications, file/Git RPCs, mobile E2EE framing, and relay transport are uncovered.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/pull/12641",
        "https://github.com/stablyai/orca/pull/12655"
      ],
      "invariant": "A client and a server built from different releases must complete subscribe, input delivery to the process, hide/reveal buffer snapshot, transport drop, and resubscribe with no frame refused by the receiving build's decoder, the same negotiated capabilities, and the same published snapshot content — so a new optional field stays safe, a new opcode is only sent after negotiation, and a change in what the host publishes is visible before release.",
      "oracle": "Run one fixed journey per general pairing (old client/new server, new client/old server, and current/current) plus the pinned reported pair, exact pre-fix main control, and candidate controls. Assert exact frames, subscriptions, input, rendered snapshot/live content, and zero decoder rejects or missing host methods. The reported and pre-fix-main clients must render blank after discarding the nonempty lossy initial image; candidate pairings must paint it once, recover the first post-snapshot sequence gap, and resume contiguous live output once.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/reported-lossy-initial-snapshot.unit.test.ts"
      ],
      "testFiles": [
        "tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
        "tests/e2e/cross-version-wire/reported-lossy-initial-snapshot.unit.test.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
          "assertions": [
            "expect(record.completed).toEqual([...JOURNEY_STEPS])",
            "expect(record.frameSequence).toEqual(EXPECTED_JOURNEY_FRAMES)",
            "expect(record.rejected).toEqual([])",
            "expect(record.inputAtProcess).toEqual([JOURNEY_INPUTS.first, JOURNEY_INPUTS.second])",
            "expect(event.capabilities).toEqual({ outputPause: 1 })"
          ]
        },
        {
          "file": "tests/e2e/cross-version-wire/reported-lossy-initial-snapshot.unit.test.ts",
          "assertions": [
            "the reported 1.4.192 client discards the reported 1.4.191 host's nonempty lossy snapshot",
            "the exact pre-fix main client reproduces the same blank rendered terminal",
            "the candidate client paints that old-host image exactly once and resumes live output",
            "the candidate client paints the candidate-host image exactly once and resumes live output",
            "both candidate pairings report zero decoder rejects and missing runtime methods"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-05",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
          "durationSeconds": 6,
          "summary": "v1.4.169 against working tree c4d5a535f2; all three pairings produced the identical 16-frame journey with zero rejected frames."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 180,
        "scope": "four historical checkout extractions plus seven in-process pairings"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "New gate; no soak history yet. The journey uses observed-state barriers only, with no sleeps or elapsed-time oracles."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Red proven separately for each rule by injecting the violation into the working tree and reverting it. Rule 2: adding opcode 17 and sending it ungated from the client turned new-client/old-server red with rejected rawOpcode 17 in the client-to-host direction, while old-client/new-server stayed green. Rule 3: making the host stop publishing the snapshot `source` field turned both new-server pairings red and left the old-server pairing green; trimming the published initial buffer removed the SnapshotChunk frame and failed the frame-sequence oracle. Rule 1: adding an optional `hiddenOutputReason` field to the snapshot frame kept all pairings green, and making the client require that field turned only new-client/old-server red."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Product reconciliation adds one existing-target comparison per completed snapshot and no timer, polling, subscription, provider call, scan, or subprocess. The test-only host hook adds one environment read per initial subscribe. Extracted trees are cached by commit."
      },
      "promotionCriteria": [
        "Extend the matrix beyond the newest stable release and pinned reported pair.",
        "Cover a second wire surface, starting with the session-tab sync channel that PR #12641 changed.",
        "Collect 100 consecutive CI passes on the dedicated cross-version-wire job.",
        "Run the job on Linux and Windows runners, not only macOS locally."
      ],
      "knownGaps": [
        "Only the terminal stream is covered; session tabs, agent sessions, file/Git RPCs, mobile E2EE framing, and the relay transport are not.",
        "The newest stable release and pinned reported pair do not expose every intermediate regression.",
        "The host runtime is a stub around a fake PTY, so real PTY, daemon, and SSH provider behavior is out of scope.",
        "The baseline is the newest release tag by default, so the compared pair changes when a new release is cut unless ORCA_CROSS_VERSION_BASELINE_REF pins it.",
        "tests/ is outside every tsconfig include, so the harness is linted and executed but not typechecked."
      ],
      "demotionRule": "Demote if the baseline checkout cannot be materialized in CI, if a pairing has to be skipped to keep the lane green, or if the journey stops asserting the full step list and frame sequence."
    },
    {
      "id": "codex.state-db-backfill-recovery-bounds",
      "title": "Codex state DB backfill recovery has bounded process and timer use",
      "maturity": "experimental",
      "protection": "none",
      "owner": "codex-runtime",
      "layer": "main-process-supervisor",
      "surfaces": [
        "Codex state DB backfill recovery",
        "managed Codex home startup",
        "Codex PTY and rate-limit recovery triggers"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "wsl", "paired-runtime-host"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1614 removes mocked backfill retry/private state assertions without equivalent replacement coverage. Retained tests exercise selected real child termination and timeout boundaries; they do not establish the retired gate assertions. Any historical receipts are retired when no current passed evidence remains. Historical scope before this audit: A deterministic injected claimant and clock cover exits before and after the former ten-second classification boundary, exact spawn/poll/backoff counts, transient exit and spawn-error recovery, owner-lock reacquisition, WSL routing, and cleanup. Live Windows, WSL, and paired-runtime-host process evidence remains uncollected.",
      "motivatingLinks": ["https://github.com/stablyai/orca/releases/tag/v1.4.177-rc.0"],
      "invariant": "One authoritative Codex state DB backfill supervisor spawns at most five claimants regardless of process lifetime, retains at most one child and one timer, rejects later automatic restarts after claimant exhaustion, and bounds pre-claim coordinator failures to five triggers while transient claimant and owner-lock failures can recover within those budgets.",
      "oracle": "Use an injected process and clock to exit every claimant at 10,001ms without waiting. Permanent failure must give up after five spawns and exits with exactly 15 poll timers and four backoffs, no live child or pending timer, and no safety-fuse abort; repeated triggers must reuse the exhausted result with zero new lock or runner calls. Separately fail twice at 10,001ms and complete on the third claimant, recover from a first-spawn error on attempt two, reacquire after a transient owner-lock failure, and cap permanent lock-root failures at five attempts across six triggers.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "deterministic main-process supervisor and owner-lock contract"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "New fake-clock gate; no arbitrary sleeps or elapsed wall-time oracle."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical production source at release commit 9e948fbdf462ede3c0160c719474100fc5cbefb7 and origin/main spawned six claimants and reached the harness fuse with 18 polls and six backoffs. The candidate gives up after five claimants with 15 polls and four backoffs; removing the total-spawn cap restores the exact red result."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The supervisor retains at most one claimant and one awaited timer. A permanent process lifetime is bounded to five subprocesses, 15 status polls, and four backoffs; later triggers reuse one settled promise and spawn nothing. Pre-claim coordinator failures perform at most five status/lock attempts. The fix adds no polling, listener, provider call, scan, wire field, or hot-path work."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Collect live Windows/WSL and paired-runtime-host recovery evidence.",
        "Keep exact spawn, exit, timer, backoff, cleanup, and transient-recovery assertions green."
      ],
      "knownGaps": [
        "Audit1614 removes mocked backfill retry/private state assertions without equivalent replacement coverage. Retained tests exercise selected real child termination and timeout boundaries; they do not establish the retired gate assertions. Any historical receipts are retired when no current passed evidence remains.",
        "Live child-process behavior is represented by an injected EventEmitter claimant.",
        "Physical Windows, WSL, SSH, and paired-runtime-host journeys were not run."
      ],
      "demotionRule": "Demote if any exit duration can evade the spawn budget, concurrent children or timers appear, cleanup retains resources, or a transient failure cannot recover within the budget."
    },
    {
      "id": "runtime.headless-serve-graceful-signal-exit",
      "title": "Packaged headless Linux serve exits cleanly after foreground signals",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "electron-headless-quit-lifecycle",
      "surfaces": ["packaged Linux AppImage", "headless orca serve", "owned Xvfb lifecycle"],
      "platforms": ["linux"],
      "providers": ["local-daemon"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": ["local-daemon"],
      "coverageNotes": "An Ubuntu 26.04 amd64 container first launches the original AppImage through dbus-run-session and xvfb-run with startup diagnostics, then extracts the packaged AppImage into disposable HOME and XDG directories, leaves APPDIR unset to preserve extracted-AppRun direct serve mode, waits for structured serve readiness, and exercises terminal-style foreground-process-group SIGINT plus the documented systemd KillMode=mixed main-PID SIGTERM in separate containers. Local evidence runs under Rosetta on an arm64 Docker host; native amd64 PR CI repeats the same startup and foreground-AppRun identity contracts.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/14109",
        "https://linear.app/stably/issue/STA-4051"
      ],
      "invariant": "After packaged foreground headless serve publishes structured readiness, one SIGINT or SIGTERM exits successfully without an Electron fatal trap or core evidence, releases the exact listener and owned Xvfb/process tree, and leaves an unrelated process identity untouched.",
      "oracle": "First start the original, readable-and-executable AppImage once in a fresh restricted Ubuntu 26.04 container through dbus-run-session -- xvfb-run -a --appimage-extract-and-run with ORCA_STARTUP_DIAGNOSTICS=1, and require the exact updater-setup-done marker within 90 seconds while fencing the launcher and owned Xvfb by PID start ticks. For each signal, start a separate unprivileged container with disposable profile and runtime directories, a random loopback port, DISPLAY unset, software GL, and the extracted AppImage in a fresh session. Wait for orca_server_ready schema version 1, record the listener owner, process tree, owned Xvfb, and unrelated canary identities, deliver SIGINT to the foreground process group or the documented KillMode=mixed graceful SIGTERM to the AppRun PID, then require wait status zero, no Failed to shutdown, SIGTRAP, core, listener, recorded descendant, profile/AppImage/Xvfb residue, or changed canary identity. The 30-second bounds are failure deadlines, never success conditions.",
      "commands": [
        "shellcheck config/docker/headless-serve-shutdown/run-signal-case.sh",
        "shellcheck config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh",
        "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage",
        "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts --maxWorkers=2 --reporter=dot"
      ],
      "testFiles": [
        "src/main/startup/ensure-virtual-display.test.ts",
        "config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs",
        "config/docker/headless-serve-shutdown/run-signal-case.sh",
        "config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh"
      ],
      "assertionRefs": [
        {
          "file": "src/main/startup/ensure-virtual-display.test.ts",
          "assertions": [
            "owned Xvfb starts with terminate-after-last-client semantics",
            "owned Xvfb uses an independent process group so terminal Ctrl-C cannot preempt Electron teardown",
            "owned Xvfb retains an early-process-exit guard until Electron is ready",
            "owned Xvfb is not stopped from Electron's cancelable will-quit event",
            "external displays and non-Linux startup remain untouched"
          ]
        },
        {
          "file": "config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs",
          "assertions": [
            "the original AppImage startup runs through dbus-run-session and xvfb-run with a bounded diagnostics marker",
            "SIGINT and SIGTERM run in separate disposable containers",
            "both signal failures are reported before the oracle exits",
            "the exact AppImage SHA-256, entrypoint, and signal target are published",
            "the read-only AppImage bind is checked for read and execute permissions before extraction",
            "the launcher exec overlay isolates the related STA-4017 signal boundary"
          ]
        },
        {
          "file": "config/docker/headless-serve-shutdown/run-signal-case.sh",
          "assertions": [
            "SIGINT reaches the isolated foreground process group while owned Xvfb stays in its own group",
            "SIGTERM reaches the exact AppRun PID under the documented systemd KillMode=mixed policy",
            "target and descendant identities are fenced by PID start ticks before signaling and residue checks"
          ]
        },
        {
          "file": "config/docker/headless-serve-shutdown/run-appimage-desktop-startup-case.sh",
          "assertions": [
            "the original AppImage emits the exact updater-setup-done startup marker within 90 seconds",
            "launcher and owned Xvfb identities are fenced by PID start ticks",
            "cleanup sends bounded TERM then KILL signals and preserves failure logs"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-13",
          "runner": "local",
          "platform": "linux",
          "command": "node config/scripts/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
          "currentCommand": "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
          "result": "passed",
          "durationSeconds": 48,
          "summary": "The extracted candidate AppRun passed process-group SIGINT and systemd-mixed main-PID SIGTERM under Ubuntu 26.04 amd64 emulation with status zero, no fatal evidence, full listener/Xvfb/tree cleanup, and an unchanged canary identity."
        },
        {
          "date": "2026-08-31",
          "runner": "ci",
          "platform": "linux",
          "command": "node config/scripts/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
          "currentCommand": "node config/scripts/runtime-verification/daemon-lifecycle/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
          "result": "passed",
          "durationSeconds": 1336,
          "summary": "Native-amd64 PR package job https://github.com/stablyai/orca/actions/runs/33360129768/job/99389831915 built AppImage SHA-256 999d43bfe123e87a77fe917a5f46be1efd5c45a5205f99f02998a75136d8a793 and ran the restricted original-AppImage startup oracle before each of the three signal matrices. Each startup reached the exact updater-setup-done marker with stable launcher/Xvfb PID-start-tick identities and bounded TERM/KILL cleanup; SIGINT and SIGTERM then returned wait status 0 with no fatal evidence, listener, descendant, Xvfb, or canary residue. This is CI evidence only; no fresh local Docker oracle is claimed."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 1800,
        "scope": "three AppImage startup/extraction matrices, each with fresh Ubuntu 26.04 INT and TERM containers"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "The event- and identity-driven harness is new; soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical Docker oracle failed process-group SIGINT and main-PID SIGTERM on v1.4.180 AppImage af3b6e6a67fc, launch-day main AppImage 017ff5abc35a, and candidate-with-fix-disabled AppImage f409f58dd9c3 with wait status 133 plus Electron Failed to shutdown and SIGTRAP. The prior candidate 5b94b86a9879 passed PID signals but failed process-group SIGINT with status 133, proving Xvfb also needed an independent process group. Final candidate AppImage 5c82936043e4 passed process-group SIGINT and the documented systemd KillMode=mixed main-PID SIGTERM with status zero and complete cleanup. A control-group TERM that also targets Xvfb remains red, proving KillMode=mixed is required for the documented owned-Xvfb unit. Applying PR #14071's launcher exec semantics with PID delivery left v1.4.180 red and the candidate green, proving the launcher and Electron/Xvfb fixes are independent and composable. On 2026-10-06, the retained behavioral unit command \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts --maxWorkers=2 --reporter=dot\" passed 33 tests locally on macOS in 5.599 seconds. This checks the portable startup/participation verifier only; no new Linux native, packaged, desktop, or hosted qualification is claimed. Historical evidence before removing the workflow-source test, preserved with the originally executed command: [{\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts config/scripts/headless-serve-shutdown-workflow.test.mjs --reporter=dot\",\"result\":\"passed\",\"durationSeconds\":1,\"summary\":\"The focused startup and workflow contracts passed with owned-display termination semantics and native amd64 CI wiring.\"}]"
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The product change adds one standard Xvfb startup flag, isolates the existing Xvfb child from foreground process-group signals, replaces one Electron lifecycle listener with a process listener that is removed at ready, and adds no polling, timer, subprocess, IPC, provider fanout, renderer work, retained payload, native dependency, or recurring hot-path work. After ready, Xvfb exits from its existing client-disconnect path."
      },
      "promotionCriteria": [
        "Collect 100 consecutive native amd64 CI or soak passes or 14 days without an unexplained flake.",
        "Collect one native Ubuntu 26.04 AppRun signal run with foreground wait status zero for both signals.",
        "Keep exact listener, Xvfb, descendant, fatal-evidence, and canary identity assertions green."
      ],
      "knownGaps": [
        "The local arm64 Docker host uses Rosetta for amd64 containers; native amd64 PR CI supplies the non-emulated repeat of the same extracted-AppRun PID contract.",
        "Ubuntu 20.04 is covered by the packaged native-binary glibc floor gate; this lifecycle journey runs on the reported Ubuntu 26.04 topology.",
        "Systemd units that override or omit the documented KillMode=mixed policy can still terminate owned Xvfb before Electron disconnects.",
        "The harness exercises foreground headless Linux shutdown and does not replace desktop, updater, SSH, or detached PTY lifecycle coverage."
      ],
      "demotionRule": "Keep experimental or demote if either signal traps, returns nonzero, retains its listener/Xvfb/run-owned process identity, touches the unrelated canary, or the focused gate flakes without an identified product or harness defect."
    },
    {
      "id": "runtime.linux-cli-launch-contract",
      "title": "Packaged Linux CLI commands run without FUSE, user namespaces, or a display",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "runtime-platform",
      "layer": "appimage-cli-entrypoint",
      "surfaces": [
        "packaged Linux AppImage",
        "bundled CLI launcher",
        "extracted direct binary",
        "desktop launch diagnosis"
      ],
      "platforms": ["linux"],
      "providers": ["local-daemon"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": ["local-daemon"],
      "coverageNotes": "A restricted Ubuntu container stages the extracted AppImage payload with no /dev/fuse and with unprivileged user namespaces denied, then runs eight CLI cases across the bundled launcher and the extracted direct binary. x64 only, because PR CI builds only --x64.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/13719",
        "https://github.com/stablyai/orca/issues/14229"
      ],
      "invariant": "On a host without FUSE and without unprivileged user namespaces, every packaged CLI entrypoint either completes its command or reports a diagnosis, and never terminates on a signal.",
      "oracle": "Build the image, stage the AppImage payload, and run each case in the restricted container. Assert the preconditions first: unshare -Ur must fail and /dev/fuse must be absent, so a relaxed runner fails the job rather than silently skipping. For each case require the exact expected exit status and an expected substring of the command's own output, with the harness RESULT/CRASHED/PRECONDITION_FAILED control lines excluded so a case name can never satisfy its own assertion. Any status of 128 or above is a crash and fails immediately. The per-case timeout is a failure deadline, never a success condition.",
      "commands": [
        "node config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
        "shellcheck config/docker/cli-launch-contract/run-cli-case.sh"
      ],
      "testFiles": [
        "config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs",
        "config/docker/cli-launch-contract/run-cli-case.sh"
      ],
      "assertionRefs": [
        {
          "file": "config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs",
          "assertions": [
            "the bundled launcher serves --help, --version, status, skills --help, and worktree list without Chromium",
            "a direct binary launch reaching JavaScript runs the command instead of booting a GUI",
            "a desktop launch with no display reports the missing-display diagnosis instead of trapping",
            "a stale DISPLAY is diagnosed rather than trusted",
            "expected output is matched against the command's own output, not the harness control lines"
          ]
        },
        {
          "file": "config/docker/cli-launch-contract/run-cli-case.sh",
          "assertions": [
            "the container refuses to run unless unprivileged user namespaces are denied and /dev/fuse is absent",
            "an exit status of 128 or above is reported as a crash rather than compared to the expected status"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-31",
          "runner": "ci",
          "platform": "linux",
          "command": "node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
          "currentCommand": "node config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
          "result": "passed",
          "durationSeconds": 40,
          "summary": "PR package job https://github.com/stablyai/orca/actions/runs/33360129768/job/99389831915 ran all eight cases to ok on ubuntu-latest. The unshare and /dev/fuse preconditions held under moby's default seccomp profile rather than tripping."
        },
        {
          "date": "2026-09-01",
          "runner": "local",
          "platform": "linux",
          "command": "node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
          "currentCommand": "node config/scripts/runtime-verification/desktop-transport/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
          "result": "passed",
          "durationSeconds": 60,
          "summary": "All eight cases passed on Ubuntu 24.04 amd64 hardware against an AppImage built from the stack tip, invoked against a copy of that artifact outside dist/."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 300,
        "scope": "eight CLI launch cases in one restricted Ubuntu container"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "The harness is new; soak history is not yet available."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The same harness run against a stock release AppImage failed four of eight cases: nofuse-userns-bundled-version at status 93, and all three direct-binary cases crashed at status 133 (SIGTRAP, the uv_close abort of #13719 and #14229). The stack-tip AppImage passed all eight. Corroborated at artifact level: the stack-tip runtime is a static-pie ELF with no PT_INTERP, the stock runtime is dynamically linked. Caveat: the two skills cases previously asserted a substring that the harness's own RESULT line contained, so they passed independently of command output; both now assert the rendered help header, and the green runs above predate that change."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "The gate is CI-only and adds no product code path."
      },
      "promotionCriteria": [
        "Collect 30 consecutive CI passes or 14 days without an unexplained flake.",
        "Extend the matrix to arm64 once PR CI builds that architecture.",
        "Re-run red/green against a stock AppImage after any change to the launcher entrypoint."
      ],
      "knownGaps": [
        "The preconditions depend on moby's default seccomp profile denying unshare(CLONE_NEWUSER) and on /dev/fuse being absent. A runner with a relaxed profile or a mounted /dev/fuse trips PRECONDITION_FAILED and fails the job rather than skipping.",
        "x64 only: PR CI builds only --x64, so the arm64 launcher path is unexercised.",
        "The harness covers CLI entrypoints only; it does not exercise a full desktop session."
      ],
      "demotionRule": "Keep experimental or demote if any case terminates on a signal, the preconditions stop holding on the CI runner, or an assertion can be satisfied by anything other than the command's own output."
    },
    {
      "id": "terminal-history.daemon-checkpoint-session-isolation",
      "title": "Daemon history checkpoints isolate stalled terminal sessions",
      "maturity": "experimental",
      "protection": "none",
      "owner": "daemon-terminal",
      "layer": "main-process-daemon-history",
      "surfaces": [
        "warm daemon terminal reattach",
        "deep daemon buffer snapshots",
        "periodic and final durable-history checkpoints"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "ssh-daemon", "wsl-daemon", "paired-runtime-host"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: A real daemon server and adapter on macOS cover per-session isolation, same-session deadlines, post-deadline commit, aggregate overlay admission, and live-window fallback. The provider-neutral adapter has no new path or wire assumptions; a live Linux SSH-relay journey covers the unchanged remote consumer, while live Linux daemon, Windows, WSL, and paired-runtime-host journeys remain gaps.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4173",
        "https://github.com/stablyai/orca/pull/14346"
      ],
      "invariant": "A stalled durable-history checkpoint may delay only its own daemon session. Warm reattach and deep snapshots degrade to the live window after five seconds, non-final background checkpoints defer after fifteen seconds, same-session writes remain serialized, non-final running plus queued work stays bounded to three per session, overlay compacts stay bounded to four across sessions, and final sleep or disconnect checkpoints remain deadline-free.",
      "oracle": "Park one session inside the real history checkpoint write, then require an unrelated warm reattach to return within two seconds with its own output while the first write remains parked. Require the stalled session to return its live window after the overlay deadline and later commit the abandoned write. Park four distinct overlay compacts, require a fifth reattach to return its live window without starting another compact, and require fast non-final RPC rejection plus both deadlines to leave diagnostic breadcrumbs.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "focused queue, real daemon-adapter isolation, and daemon adapter regression suite"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Fresh deterministic local runs pass; CI and soak history have not started."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Origin main routes the parked overlay through one process-wide checkpoint tail, while the candidate oracle observes unrelated reattach at about 79 milliseconds. The exact reverted-source oracle was not executed in this review worktree."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Non-final work holds one admission per session and four globally; a full admission set stops the current periodic pass after four probes, and its diagnostic state stays bounded to the active admissions plus one global marker. Deadline timers are unrefed, abandoned waits retain admission until the actual write settles, dirty-gated polling remains unchanged, final checkpoints remain deadline-free, and the change adds no subprocess, renderer, store, startup probe, or wire work."
      },
      "promotionCriteria": [
        "Execute the oracle against an affected baseline and retain the exact red result.",
        "Collect 100 consecutive focused CI passes or 14 days of soak history.",
        "Collect live Linux daemon, Windows, WSL, and paired-runtime-host reattach evidence.",
        "Keep per-session and aggregate admission, deadline, diagnostics, and final-checkpoint assertions green."
      ],
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Live Electron evidence covers the unchanged Linux SSH-relay consumer rather than a daemon running on the SSH host.",
        "Physical Windows, WSL, Linux daemon, and paired-runtime-host journeys were not run.",
        "The reverted-source failure is established from the old process-wide call path but was not executed."
      ],
      "demotionRule": "Demote if unrelated reattach joins a stalled session tail, overlay or periodic work exceeds its admission bound, a deadline cancels durable work, final checkpoints defer, or failures and deadline fallbacks lose their diagnostic breadcrumbs."
    },
    {
      "id": "skill-upload.cross-process-staging-ownership",
      "title": "Concurrent runtime and relay uploads retain exact staging ownership",
      "maturity": "experimental",
      "protection": "none",
      "owner": "skill-upload-session-service",
      "layer": "host-filesystem-lifecycle",
      "surfaces": [
        "paired-runtime skill upload",
        "SSH relay skill upload",
        "upload cancellation",
        "process restart and disposal"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["orca-server", "ssh"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Two independent services share one parent under controlled ordering, four real crash boundaries run in child processes, and two bundled relays share one isolated home through distinct socket and hook endpoints. A current relay also shares that home safely with the originating relay in both launch orders. Graceful relay and desktop-runtime disposal join service cleanup. Linux, Windows, and paired headed/headless runtime process evidence remain uncollected; the change is host-local and changes no wire payload.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4967",
        "https://github.com/stablyai/orca/pull/14934"
      ],
      "invariant": "Initialization, cleanup, or disposal by one service process can never remove bytes owned by a still-live upload in another process. Each service owns one atomic PID-and-UUID namespace, serializes begin admission at four active sessions, and retains the package-size limit. Abandoned owner cleanup inspects at most 64 entries per attempt, and success, failure, cancellation, restart, and disposal release only their exact owned paths.",
      "oracle": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Begin and partially append upload A, then begin and append upload B from an independent service or relay sharing the same parent. Require two exact PID-and-UUID owner directories, two upload-ID archives, and byte-for-byte survival of both. Cancel B then A and require archive counts 1 then 0. Stage two more live uploads, terminate relay A, and require relay B's exact owner, archive, and bytes to survive before B terminates and the root becomes empty. Kill real child owners at begun, partial, uploaded, and committed boundaries and require a fresh owner to remove only exited-process staging and complete its own transfer. Seed 65 exited owners, require one attempt to remove exactly 64 and reject before adding bytes, then require retry to drain the final stale owner and begin normally.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "focused service, four child-process restarts, and two bundled relays"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "The barriers are request acknowledgements, filesystem state, and process exit; CI and soak history have not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): The byte-identical two-relay oracle failed at the exact two-owner count on originating merge fa9b20cb4163 and latest-main/reverted source 012e9f410c76, each observing one shared-root entry after relay B began. The candidate passed with two owner directories, two archives, A-byte survival, 1-to-0 cancellation cleanup, and 1-to-0 owner disposal cleanup."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Initialization scans at most 64 direct parent entries, creates one owner directory per live service, retains the existing four active sessions and package-size caps, and adds no polling, timer, subprocess, wire field, renderer work, or provider fanout. An over-budget parent rejects before creating new staged bytes."
      },
      "promotionCriteria": [
        "Collect 100 consecutive focused CI passes or 14 days without an unexplained flake.",
        "Run the same two-owner relay topology on Linux and Windows.",
        "Run paired headed and headless runtime uploads under one OS account.",
        "Keep exact owner/file counts, byte survival, bounded sweep, and all four crash boundaries green."
      ],
      "knownGaps": [
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/skills/skill-upload-session-service.test.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching src/main/skills/skill-upload-session-service.test.ts are retired below as historical raw objects; their counts do not validate reduced commands. The only passing receipt is retired, so protection becomes none pending a fresh run. Original current selectors and assertion inventory, preserved as historical data only: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts --reporter=verbose\",\"ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose\",\"ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose\"],\"testFiles\":[\"src/main/skills/skill-upload-session-service.test.ts\",\"src/main/skills/skill-upload-process-restart.integration.test.ts\",\"src/main/skills/skill-upload-process-restart-child.test.ts\"],\"assertionRefs\":[{\"file\":\"src/main/skills/skill-upload-session-service.test.ts\",\"assertions\":[\"a second service preserves the first service's exact file and bytes\",\"five concurrent begins admit exactly four sessions and disposal removes them\",\"disposal waits for an initializing begin and leaves no owner\",\"concurrent disposal callers join the same exact cleanup promise\",\"archive hashing failure releases the session and rejects later appends\",\"symlink or junction staging roots are rejected before cleanup or admission\",\"failed archive removal remains owned and counts toward the four-path bound\",\"cancellation and disposal reduce exact archive and owner counts\",\"one abandoned-owner sweep removes at most 64 entries and retry completes\"]},{\"file\":\"src/main/skills/skill-upload-process-restart.integration.test.ts\",\"assertions\":[\"begun, partial, uploaded, and committed crash residue is reclaimed\",\"the replacement transfer completes and leaves no owner directory\"]}],\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"ssh\"]}. No claim that retained test bodies disappeared. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-08-20\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose\",\n          \"durationSeconds\": 5.95,\n          \"summary\": \"Fifteen service tests, four crash-boundary cases, and one two-current-relay topology passed; the child fixture and two explicitly separate mixed-version cases skipped.\"\n        }",
        "The live two-relay and crash evidence was collected on macOS; Linux and Windows process/filesystem behavior remains CI coverage.",
        "The service is shared by paired runtimes, but separate headed and headless paired-runtime process journeys were not run.",
        "PID reuse is handled conservatively: an abandoned namespace whose PID is currently occupied is preserved until a later process generation rather than risking deletion of live bytes.",
        "The legacy remote-uploads root is intentionally not reclaimed while a mixed-version relay may still own bytes there; eventual legacy-root retirement requires a separate compatibility decision."
      ],
      "demotionRule": "Demote if one live owner can remove another owner's bytes, cleanup exceeds 64 inspected entries per attempt, a lifecycle path retains its exact owned archive after settlement, or the process oracle flakes without an identified harness or product defect."
    },
    {
      "id": "terminal-startup.quick-command-pre-bind-recovery",
      "title": "Quick Command survives a pre-bind terminal recovery",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-renderer-lifecycle",
      "layer": "electron-ui-and-real-local-pty",
      "surfaces": ["Quick Commands", "terminal pane recovery", "fresh PTY startup"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local"],
      "coverageNotes": "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the complete pane-split-startup wrapper suite and selector. Its temporary dependency-field exposure/reset, sequential payload isolation and thrown-sentinel cleanup alarms are lost; no quick command, process or PTY startup was exercised by those callbacks. Remaining queued-startup/ownership sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): A forced pre-spawn barrier makes one visible Quick Command cross a recovery remount before its successor PTY binds. Lifecycle contracts retain lower-layer ownership; the Electron sentinel adds the rendered affordance, real PTY, exact-once terminal marker, staged identity file, and unrelated sibling canary. The test-value audit removed the store examples for retaining an undelivered queued startup command across remount, distinct queued ownership, sibling-bind preservation, unspawned close, and sibling queue isolation. The remaining store cases exercise recovery admission/settlement and non-replay after consumption; neither covers an undelivered command. The store suite is retired from this gate. Retained lifecycle and historical Electron evidence do not establish equivalent replacement coverage; historical commands and results remain historical. Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4876",
        "https://github.com/stablyai/orca/pull/15630"
      ],
      "invariant": "A Quick Command selected for a new terminal remains owned by that tab through a recovery remount, executes exactly once only after the successor PTY binds, and never reaches an unrelated terminal.",
      "oracle": "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1925 (sources1922/1923): Delete the complete pane-split-startup wrapper suite and selector. Its temporary dependency-field exposure/reset, sequential payload isolation and thrown-sentinel cleanup alarms are lost; no quick command, process or PTY startup was exercised by those callbacks. Remaining queued-startup/ownership sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Historical prior account (preserved verbatim): Arm the E2E-only pre-spawn barrier, click the visible Quick Command, force one recovery generation while the original spawn is blocked, and release it. Require one exact semantic xterm marker, an independently written pane/tab identity file matching the bound live PTY, queue consumption only after bind, and a live interactive sibling canary.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-owner-hydration-backend-retention.test.ts src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts --reporter=dot",
        "pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/terminal-pane/pty-connection/host-ownership/pty-connection-owner-hydration-backend-retention.test.ts",
        "src/renderer/src/components/terminal-pane/mounting/queued-pane-startup.test.ts",
        "src/renderer/src/components/terminal-pane/parking/one-shot-park-replay.test.ts",
        "tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts",
          "assertions": [
            "the visible Quick Command executes exactly once in the intended fresh PTY",
            "queue consumption follows PTY binding and the sibling terminal remains live"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-23",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "durationSeconds": 23,
          "summary": "The exact rebased PR head passed the headless Electron flow in 23.0 seconds after an E2E-mode build."
        },
        {
          "date": "2026-08-23",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "durationSeconds": 24,
          "summary": "The exact rebased PR head passed the visible-window Electron flow in 23.9 seconds using the same E2E build."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "one isolated Electron app, one forced recovery remount, and two local PTYs"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "The new sentinel has local headless and forced-headful evidence but no routed CI soak history."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The byte-identical spec failed with pending:null before PTY bind when the pre-6e25a900 eager-consume behavior was restored, then passed after restoration."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "The barrier exists only in E2E builds, adds no production timer or polling, and the live sentinel completed in under 20 seconds locally."
      },
      "promotionCriteria": [
        "Collect 100 consecutive routed CI passes over at least 14 days without an unexplained flake.",
        "Keep retries at zero and retain both semantic and identity oracles.",
        "Collect Linux Electron evidence before promoting the focused lane to blocking."
      ],
      "knownGaps": [
        "Audit3045 proposes deleting the queued-startup callback-wiring suite and its current selector. Bind-before-consume, no-spawn callback and throwing-consumer alarms are intentionally retired; retained E2E assertionRefs and original dated receipts remain unchanged within their original scope. No fresh gate, native PTY or equivalent replacement coverage is claimed.",
        "Audit1743 removes the standalone line-height clamp/default and pane cwd fallback helper tests (5 authored cases). These trivial-helper alarms are intentionally lost, with no equivalent replacement. Only current commands/testFiles lose the deleted selectors; historical receipts and evidenceRuns remain unchanged and do not validate the reduced commands.",
        "Windows, Linux, SSH, WSL, and paired-runtime topologies are not covered because they were not causal to STA-4876.",
        "The sentinel remains advisory while the repository-wide E2E signal is red.",
        "The test-value audit removed the store examples for retaining an undelivered queued startup command across remount, distinct queued ownership, sibling-bind preservation, unspawned close, and sibling queue isolation. The remaining store cases exercise recovery admission/settlement and non-replay after consumption; neither covers an undelivered command. The store suite is retired from this gate. Retained lifecycle and historical Electron evidence do not establish equivalent replacement coverage; historical commands and results remain historical.",
        "Audit1880 removes the entire mounted-terminal-scrollback.test.ts suite. Its direct fake-terminal scrollback option-assignment and repeated-value write-budget alarm is intentionally lost; no actual xterm output-retention or equivalent replacement coverage is claimed. Only its exact tokens in current commands and its testFiles entry are removed. Existing unrelated dated receipts, their raw objects and platform/provider accounting remain unchanged; they do not validate the reduced command selector.",
        "Audit1903 removes whole mocked detach, supplied geometry and/or close-request suites selected by this gate. Their pending-CWD/PTY-binding argument/order, fabricated hit-test and close bookkeeping alarms are intentionally lost without replacement. Valid remaining selectors/assertions and unchanged-selector execution receipts retain their original scope. Reduced unit selections have no fresh broad gate, real PTY/provider, rendered focus, or measured-budget validation. Exact lost direct alarms: 'detaches a rolled-back split surface without closing its PTY'; \"closes a tab through its last pane with the requester's reason, never an implied user close\"; 'uses non-destructive tab close semantics for the last rolled-back pane'; 'ignores a delayed rollback after the pane PTY identity changed'; 'retires a mounted rollback pane without detaching it as a movable surface'; 'retires mounted authority and binding while preserving the process and sleeping fence'; 'suppresses the pane PTY exit before intentional close teardown destroys the transport'; 'does not suppress natural PTY exits that already cleared the transport id'.",
        "Audit1925 (sources1922/1923): Delete the complete pane-split-startup wrapper suite and selector. Its temporary dependency-field exposure/reset, sequential payload isolation and thrown-sentinel cleanup alarms are lost; no quick command, process or PTY startup was exercised by those callbacks. Remaining queued-startup/ownership sources are not equivalent replacements. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'only exposes startup to the intentional split and clears it afterwards'; 'isolates startup payloads across sequential calls (setup then issue)'; 'clears startup even when splitPane throws'.",
        "Audit1931 (sources1928/1929): Delete complete transport-unmount and queued-initial-CWD helper suites: despite lifecycle-shaped fixtures, the unmount owner returns a Boolean PTY-id predicate, while CWD cases check nullish field selection and callback counts. Lose their detach/destroy/teardown and one-shot-CWD supplied examples. Partial queued-pane-startup loses three identical/empty/nonowner identity examples, retaining four exact one-shot/replacement ownership callbacks. No assertion object maps to these three sources, so unrelated alias objects remain byte-exact. Preserve the current81ed prior removal of pane-split-startup; stale bd948 source metadata snapshots are not replayed. No actual process/PTY startup, transport shutdown, live SSH or rendered recovery is proven by this metadata change. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'detaches when the tab still owns the transport PTY'; 'detaches when a mirrored replacement tab owns the same PTY'; 'detaches when closeTab already owns provider shutdown for the removed tab'; 'destroys an ID-less transport so a pending spawn cannot outlive unmount'; 'detaches a removed automation pane after closeTab takes teardown authority'; 'consumes the queued initial cwd once when the ref is unset'; 'reuses the existing queued state without re-reading the store'; 'clears the one-shot cwd and restores the default cwd after the first pane'; 'leaves the cwd unchanged when no one-shot override is queued'; 'denies ownership to a split payload structurally identical to the queued command'; 'denies ownership when the tab queued nothing, so an unrelated pane cannot spend a slot'; 'withholds the consumer from a pane that does not own the queued command'.",
        "Audit2052 (sources2049/2050/2051): Remove complete low-value restored-pane-title and pane-visibility-identity suites and their current selectors. Their supplied snapshot/title and nullable identity-comparison alarms are intentionally lost without replacement. Unrelated dated evidenceRuns remain unchanged and do not validate the reduced commands. No fresh gate execution, actual PTY/provider, rendered, remote/mobile or cross-platform result is claimed."
      ],
      "demotionRule": "Demote if the barrier can be bypassed nondeterministically, either independent oracle is removed, the sibling canary is no longer isolated, or one unexplained flake occurs."
    },
    {
      "id": "quick-open.paired-host-path-search",
      "title": "Paired Quick Open searches bounded host paths",
      "maturity": "experimental",
      "protection": "none",
      "owner": "runtime-filesystem",
      "layer": "host-file-search-and-paired-runtime",
      "surfaces": ["Quick Open", "paired desktop runtime", "headless runtime host"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "ssh", "paired-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Focused contracts cover bounded host search, ignore traversal, RPC response bounds, renderer cancellation, deterministic ordering, and transport payload size. Headed and headless paired-runtime journeys use an 88,763-file fixture and are source-routed into advisory PR E2E; physical SSH and Windows remain gaps. The test-value audit removes direct routing/option/count ledgers, supplied projections, bounds-only negatives and update-copy matching from the renderer search/listing suite. Retained legacy client/cache compositions use mocked transport and do not prove real filesystem search, bounded host payload delivery, server option enforcement or equivalent replacement coverage. Historical commands and results remain historical.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-4354",
        "https://github.com/stablyai/orca/pull/15158"
      ],
      "invariant": "Quick Open queries execute on the worktree host, find exact ignored-path matches beyond the legacy inventory prefix, return deterministic bounded results, and keep the paired runtime usable without overflowing its outbound reply buffer.",
      "oracle": "Create 88,763 paths with 77,792 ignored entries and a nominal 22 GiB sparse file, query exact late gitignored and .orcaignored targets through headed and headless paired runtimes, and require one deterministic match, a payload below 4 KiB, and a healthy follow-up worktree call.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 300,
        "scope": "focused deterministic contracts plus two serial paired Electron large-tree journeys"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "The sentinel is newly source-routed for PR collection; no route-specific soak history exists yet."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The merged STA-4354 oracle places both targets beyond the removed inventory prefix; the old client-side prefix inventory misses them, while host search returns the exact deterministic paths."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Search is query-driven, result-limited, cancellation-aware, and payload-bounded; PR routing selects this fixture only for its exact production authorities or direct spec edits."
      },
      "promotionCriteria": [
        "Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
        "Collect physical SSH and Windows paired-runtime evidence.",
        "Keep deterministic result hashes, payload bounds, and post-query runtime health green."
      ],
      "knownGaps": [
        "Audit1634 removes low-value IPC, filesystem and runtime projections, argument inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained cancellation, ownership, authorization, filesystem and SQLite boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The live large-tree evidence uses local headed and headless hosts rather than physical SSH.",
        "Windows path-search tooling and filesystem behavior are not represented by the local evidence."
      ],
      "demotionRule": "Demote if the routed fixture flakes without a diagnosed product or harness cause, returns unbounded payloads, misses either late ignored target, or leaves the paired runtime unhealthy."
    },
    {
      "id": "terminal-session.host-cold-park-stream-continuity",
      "title": "Host cold parking preserves paired terminal streams",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime-graph",
      "layer": "renderer-runtime-graph-and-terminal-stream",
      "surfaces": [
        "host terminal cold park",
        "parked CLI terminal split",
        "paired remote viewer",
        "multi-pane runtime graph",
        "headless runtime restart",
        "pending terminal handle recovery"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local-daemon", "ssh-daemon", "paired-runtime"],
      "coveredPlatforms": ["macos"],
      "coveredProviders": ["local-daemon", "paired-runtime"],
      "coverageNotes": "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The paired serve-restart file loses only the expensive automation-run-ID restart case. Its original terminal journey remains byte-identical: daemon/fixture process identity survives replacement serve, keyboard/output/grid/history/checkpoint converge and authoritative close removes the binding. LAYOUT_OWNER_BUILD gates its pending-handle assertion. Existing dated receipt objects and assertion references retain their original terminal-journey scope and provide no fresh validation of the reduced file selector. Audit3362 retires the whole orphan-recovery adoption-regressions suite, including thrown-adoption/post-adoption malformed or unavailable retries, prior-binding preservation, projected sibling retirement merging and blocked local-close/group-move fencing. Its compound unit token, test-file entry and assertion reference are removed. Injected inventory/adoption projections did not demonstrate usable input delivery. Two unrelated macOS E2E receipts remain verbatim; no equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit 3318 reduces web-session-terminal-pending-handle-recovery.test.ts, intentionally retiring disconnected retry, two-authoritative-absence retirement, explicit close-record short circuit, older-host disconnected absence, positive published-presence protection and unpublished-frame no-count alarms. Remove only the disconnected-retry assertion alias; preserve transient-retry assertion and both unchanged active Electron receipts. The remaining absence-reset interleaving is narrower, not an equivalent replacement for these six removed cases. Historical receipts retain their original scope. No fresh runtime, host/PTY/network, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit1939 (sources1934/1935): Pruned cold-parking hook and parked-watcher suites retain local timer/selection/split and exit/cancel/disposal progression. Lose supplied capability/eligibility/topology/admission and duplicate state examples recorded below. No assertion objects map to these sources here; preserve independent actual E2E receipt scopes without transferring their results to reduced units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic policy and multiplex tests separate renderer parking from authoritative stream liveness, while runtime-graph tests cover exact parked leaf, pane runtime ID, title, multi-pane active-leaf, disposal behavior, and queued split routing to an exact cold-parked tab. A real Electron journey runs the shipped dev CLI against the app's isolated profile, proves the exact parked target alone remounts under a bounded lease, completes before the historical 10-second timeout without stealing active tab or focus, re-parks, then reveals two stable-identity panes with independent keyboard/output round trips. Focused mirror-recovery tests preserve a verified binding across pending-handle snapshots, quarantine positive PTY-identity mismatches, accept authoritative ready replacement or removal, and fence recovery to the pairing revision. Daemon attach-only tests prove a replacement runtime re-registers one active session and one history writer. Headed cold-park and headless runtime-restart paired journeys prove rendered output, input, resize convergence, process identity, authoritative close, checkpoint continuity, and post-restart history append against real daemon PTYs. The parked-leaf graph fixture now retains only PTY exit during the park handoff gap. Its standalone exact leaf/title, multi-pane active-leaf and disposal assertions were removed. web-runtime-session.test.ts no longer supplies the eager worktree-switch/post-create recovery assertion. Those alarms are lost; the remaining cold-park and recovery journeys do not establish equivalent replacement coverage. Recovery references retain old-host-to-new-tab mirroring, adoption/list recovery, blocked local ownership changes, coalescing/overtaking/global concurrency, adoption-conflict serialization and pane-resolution retries. Stable unsupported/malformed adoption tables, supplied inventory/topology/identity and verified-binding shape examples were removed. Their separate alarms are lost; remaining compositions are not equivalent coverage. Historical executed commands and results remain historical. The separate Unsubscribe-to-raw-subscriber-veto-clear sample was removed. Its exact raw-presence transition alarm is lost; remaining fake-provider streaming/attachment checks and real paired journeys do not establish equivalent replacement coverage. The deterministic second subscription is a second live connection, not a disconnect/reconnect proof. Audit1292: The entire orphan-inventory retry suite is removed. Unchanged-snapshot retry for temporarily absent, pending or attached PTYs, live-binding preservation, and consecutive-absence confirmation reset after a ready frame are lost. Mock adoption/list behavior and assembled snapshot handling did not establish actual orphan adoption or equivalent replacement coverage. Audit1342: src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts reduced. Exact global RPC concurrency4/counts for fabricated worktrees. No equivalent replacement coverage is claimed.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-2854",
        "https://github.com/stablyai/orca/pull/15514",
        "https://github.com/stablyai/orca/issues/12115",
        "https://github.com/stablyai/orca/issues/17297"
      ],
      "invariant": "Cold parking or restarting a host renderer/runtime never retires a live PTY's runtime-graph leaf, erases a paired viewer's last verified leaf binding merely because the host temporarily publishes pending-handle, or drops the surviving PTY's history writer. A split request for a cold-parked tab replays against its stable source leaf after exact-tab remount without switching workspaces or focusing the tab. The paired stream, input, resize, pane identity, multi-pane routing, checkpoint, and output log converge to the authoritative ready handle; the binding clears only after positive replacement, mismatch, or two consecutive authoritative absence observations without an intervening ready surface.",
      "oracle": "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The paired serve-restart file loses only the expensive automation-run-ID restart case. Its original terminal journey remains byte-identical: daemon/fixture process identity survives replacement serve, keyboard/output/grid/history/checkpoint converge and authoritative close removes the binding. LAYOUT_OWNER_BUILD gates its pending-handle assertion. Existing dated receipt objects and assertion references retain their original terminal-journey scope and provide no fresh validation of the reduced file selector. Audit3362 retires the whole orphan-recovery adoption-regressions suite, including thrown-adoption/post-adoption malformed or unavailable retries, prior-binding preservation, projected sibling retirement merging and blocked local-close/group-move fencing. Its compound unit token, test-file entry and assertion reference are removed. Injected inventory/adoption projections did not demonstrate usable input delivery. Two unrelated macOS E2E receipts remain verbatim; no equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed. Audit 3318 reduces web-session-terminal-pending-handle-recovery.test.ts, intentionally retiring disconnected retry, two-authoritative-absence retirement, explicit close-record short circuit, older-host disconnected absence, positive published-presence protection and unpublished-frame no-count alarms. Remove only the disconnected-retry assertion alias; preserve transient-retry assertion and both unchanged active Electron receipts. The remaining absence-reset interleaving is narrower, not an equivalent replacement for these six removed cases. Historical receipts retain their original scope. No fresh runtime, host/PTY/network, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit1939 (sources1934/1935): Pruned cold-parking hook and parked-watcher suites retain local timer/selection/split and exit/cancel/disposal progression. Lose supplied capability/eligibility/topology/admission and duplicate state examples recorded below. No assertion objects map to these sources here; preserve independent actual E2E receipt scopes without transferring their results to reduced units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Historical prior account (preserved verbatim): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Cold-park a host-owned pane while a paired client actively views it, require the host manager to unmount, then type through the client and require the same PTY to receive and echo the token without any disconnected sample. Restart a real pinned-port headless runtime while its daemon PTY survives, observe a pending-handle snapshot, require the viewer binding never to become empty, then require rendered output, focused keyboard input, a post-recovery window resize, the pre-restart checkpoint, and post-restart output-log append to reach the same PTY and process before authoritative close clears the binding. Invoke the real `orca-dev terminal split` against a cold-parked renderer-owned tab, require only that tab to acquire and release the existing background-mount lease, complete before the historical timeout, preserve the active worktree/tab/focus, then reveal two rendered panes and type through each while retaining the stable source leaf and PTY. Deterministically require synchronous stable-leaf replay after lifecycle registration and fail closed for a missing or stale leaf. Separately publish multi-pane parked leaves with exact pane runtime IDs and require per-PTY disposal to remove only the retired leaf.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/layout/split/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/terminal/layout/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/hosted-terminals/recovery/panes/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot",
        "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter-cold-restore-reanchor.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter-session-adoption.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter-protocol-compatibility.test.ts src/main/daemon/providers/adapter/testing/daemon-pty-adapter-history-recovery.test.ts --reporter=dot",
        "pnpm exec playwright test tests/e2e/host-parked-pane-remote-viewer.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec playwright test tests/e2e/terminal-parked-cli-split.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
        "pnpm exec playwright test tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
      ],
      "testFiles": [
        "src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts",
        "src/renderer/src/components/terminal-pane/layout/split/terminal-pane-split-request-routing.test.ts",
        "src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts",
        "src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts",
        "src/main/runtime/terminal/layout/orca-runtime-terminal-split-authority.test.ts",
        "src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-parked-leaf.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery-regressions.test.ts",
        "src/renderer/src/runtime/hosted-terminals/recovery/panes/web-session-terminal-pending-handle-recovery.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter-cold-restore-reanchor.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter-session-adoption.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter-protocol-compatibility.test.ts",
        "src/main/daemon/providers/adapter/testing/daemon-pty-adapter-history-recovery.test.ts",
        "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts",
        "tests/e2e/host-parked-pane-remote-viewer.spec.ts",
        "tests/e2e/terminal-parked-cli-split.spec.ts",
        "tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "src/renderer/src/components/terminal-pane/layout/split/terminal-pane-split-request-routing.test.ts",
          "assertions": [
            "a cold-parked split request acquires only the exact tab's background-mount lease and replays synchronously on lifecycle registration",
            "a reminted numeric pane ID resolves through the stable source leaf while a missing or stale leaf fails closed",
            "expired, canceled, closed-tab, and overflowed requests release their bounded queue and lease state"
          ]
        },
        {
          "file": "src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-parked-leaf.test.ts",
          "assertions": ["drops the leaf when the PTY exited into the park handoff gap"]
        },
        {
          "file": "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts",
          "assertions": [
            "a fully unmounted host renderer still streams, accepts input, and resubscribes"
          ]
        },
        {
          "file": "tests/e2e/host-parked-pane-remote-viewer.spec.ts",
          "assertions": [
            "a cold-parked host pane carries a complete paired-client input and echo round trip"
          ]
        },
        {
          "file": "tests/e2e/terminal-parked-cli-split.spec.ts",
          "assertions": [
            "the shipped dev CLI completes an exact parked-tab split before the historical 10-second timeout",
            "only the parked target mounts under the bounded lease while the decoy worktree, tab, active leaf, and keyboard focus stay unchanged",
            "the target re-parks, then reveals two visible panes with the stable source leaf, PTY, and handle intact",
            "both the source and created pane accept scoped keyboard input and render independently generated output"
          ]
        },
        {
          "file": "tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts",
          "assertions": [
            "a real headless runtime restart never empties the viewer's verified binding while the daemon PTY survives",
            "rendered output, focused input, and resized grid delivery converge after the replacement runtime is ready",
            "the original fixture process survives while its pre-restart checkpoint and post-restart history append remain durable",
            "authoritative tab close removes the viewer binding"
          ]
        },
        {
          "file": "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts",
          "assertions": ["mirrors a new CLI tab after old-host recovery when $name"]
        },
        {
          "file": "src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts",
          "assertions": [
            "serializes a newer convergence snapshot after an in-flight adoption conflict"
          ]
        },
        {
          "file": "src/renderer/src/runtime/hosted-terminals/recovery/panes/web-session-terminal-pending-handle-recovery.test.ts",
          "assertions": [
            "retries a transient pane-resolution failure for an unchanged replayed snapshot"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-08-29",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "pnpm exec playwright test tests/e2e/terminal-parked-cli-split.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "durationSeconds": 24,
          "summary": "A real isolated-profile Electron run passed in 23.0 seconds: the shipped CLI split the exact cold-parked renderer tab before its historical timeout, only that tab mounted and released its background lease, the decoy selection and focus remained unchanged, and both stable-identity panes completed rendered keyboard/output round trips after reveal.",
          "currentCommand": "pnpm exec playwright test tests/e2e/terminal-parked-cli-split.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        },
        {
          "date": "2026-08-29",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
          "durationSeconds": 36,
          "summary": "A clean exact-source build passed the real pinned-port serve replacement in 27.4 seconds: the daemon PTY and fixture PID survived, the renderer observed pending-handle without an empty or divergent binding, output/input/resize converged, history checkpoint and output.log continuity held, and authoritative close removed the surface. An exact-bundle repeat also passed.",
          "currentCommand": "pnpm exec playwright test tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 360,
        "scope": "Historical pre-audit selector budget; changed selectors have no new runtime measurement. Unchanged receipts remain scoped to their own commands."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Changed selectors have no new soak result after Audit1342; any retained unchanged-source receipts apply only to their own commands. Historical account: The cold-park, parked CLI split, and restart sentinels are source-routed for PR collection; route-specific CI history has not started."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1342 changed referenced test sources; no new red/green validation of the reduced set. Historical account: On the affected STA-2854 path, cold parking removed the runtime-graph leaf and the paired stream disconnected; retaining the exact live parked watcher leaf keeps every sampled client phase connected and completes input plus echo. Issue #17297 records the same-handle Windows A/B: the parked split failed after 11 seconds while an explicit switch made it immediate; the fixed macOS Electron journey completes before that 10-second internal timeout without a switch, preserves the decoy context, and renders independent round trips in both panes. Before the #12115 fix, the real restart delivered pending-handle and the viewer's tab identity rotated away from its retained layout binding; output still painted but post-restart keyboard output never reached output.log because attach-only adoption registered no active history writer. The fixed journey keeps one identity and appends history, while deterministic tests separate ready replacement, positive mismatch, safe retention, exact adoption, and removal."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Publication reads the existing bounded parked-watcher registry. Parked split routing retains at most 32 requests and 32 exact-tab leases, uses the existing three-second background mount window, cancels on close, and adds no polling or provider scan. Pending recovery is event-driven, capped at 64 exact candidates, and pairing-revision fenced. Each environment/revision/worktree key runs one active request plus only the latest trailing frame; the global RPC lane permits at most 4 active and 64 waiting calls; dispositions are capped at 512 fingerprints; ready/removal frames overtake degraded recovery. A repeated semantic snapshot version can retry a transient adoption failure without polling. The path adds no wire field, and its live journeys are selected only by exact parking, split-routing, recovery, stream, and daemon-attach authorities."
      },
      "promotionCriteria": [
        "Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
        "Collect Linux, Windows, WSL, and physical SSH cold-park/restart evidence.",
        "Keep exact per-leaf disposal, multi-pane identity, pending-binding retention, and full client round-trip assertions green."
      ],
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "The live paired cold-park, parked CLI split, and runtime-restart journeys are macOS-only and use a local daemon PTY; the #17297 report itself was Windows 11.",
        "Physical SSH, WSL, Linux, and Windows cold-park/restart journeys are not recorded.",
        "Persisted-empty viewer rows recover through an exact host pane resolution when the host exposes a valid UUID leaf and matching connected PTY; legacy/malformed layouts or hosts without terminal.resolvePane remain pending until a newer authoritative snapshot.",
        "A normal daemon-preserving runtime restart keeps the terminal handle stable; deterministic unit coverage, not the live restart, proves convergence to a distinct ready replacement handle and rejection of recycled-handle PTY mismatch.",
        "The parked-leaf graph fixture now retains only PTY exit during the park handoff gap. Its standalone exact leaf/title, multi-pane active-leaf and disposal assertions were removed. web-runtime-session.test.ts no longer supplies the eager worktree-switch/post-create recovery assertion. Those alarms are lost; the remaining cold-park and recovery journeys do not establish equivalent replacement coverage.",
        "Recovery references are narrowed to retained retry/absence confirmation, old-host-to-new-tab mirroring, adoption/list recovery, blocked local ownership changes, coalescing/overtaking/global concurrency, adoption-conflict serialization and pane-resolution retries. Stable unsupported/malformed adoption tables, supplied inventory/topology/identity and verified-binding shape examples were removed. Their separate alarms are lost; remaining compositions are not equivalent coverage. Historical executed commands and results remain historical.",
        "Audit1292: The entire orphan-inventory retry suite is removed. Unchanged-snapshot retry for temporarily absent, pending or attached PTYs, live-binding preservation, and consecutive-absence confirmation reset after a ready frame are lost. Mock adoption/list behavior and assembled snapshot handling did not establish actual orphan adoption or equivalent replacement coverage.",
        "Audit1292 retired the complete dated receipt after removal of a source in its command. Its results do not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-08-29\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"result\": \"passed\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot\",\n          \"durationSeconds\": 8,\n          \"summary\": \"Fifteen deterministic files passed watcher, exact cold-parked split routing, multi-pane graph, pending-binding retention, exact adoption, mismatch quarantine, consecutive-absence confirmation, queue/cache bound, revision-fence, and eager-refresh tests.\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot\"\n        }",
        "Audit1342: src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts reduced. Exact global RPC concurrency4/counts for fabricated worktrees. No equivalent replacement coverage is claimed.",
        "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-11-04\",\n          \"runner\": \"local\",\n          \"platform\": \"linux\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 14.82,\n          \"summary\": \"Test Files  12 passed (12); Tests  86 passed (86). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n        }",
        "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"local-daemon\",\"paired-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts\",\n    \"assertions\": [\n      \"coalesces degraded frames to one active and one latest queued recovery\",\n      \"lets a newer fully ready frame overtake an in-flight degraded recovery\",\n      \"limits recovery RPC concurrency globally across worktrees\"\n    ]\n  }\n]",
        "Audit1939 (sources1934/1935): Pruned cold-parking hook and parked-watcher suites retain local timer/selection/split and exit/cancel/disposal progression. Lose supplied capability/eligibility/topology/admission and duplicate state examples recorded below. No assertion objects map to these sources here; preserve independent actual E2E receipt scopes without transferring their results to reduced units. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'parks paired-runtime tabs only when their exact host advertises restore'; 'skips parking scans for capability-equivalent status writes and scans membership changes'; 'keeps eviction-exempt tabs mounted when the worktree is force-parked'; 'resolves eviction exemptions once per force-park input change'; 'does not exempt a tab from a truncated malformed pane key'; 'never starts a watcher for a PTY that exited into the park handoff gap'; 'collapses the exited leaf out of the stored layout when deferring'; 'retires launch/title hints when the launch-owning parked leaf exits'; 'keeps launch ownership when only a parked shell sibling exits'; 'rejects ordinary parking for a preserved daemon with a lossy snapshot'; 'rejects a capture containing a PTY without snapshot backing'; 'accepts layout-derived candidates when the capture is stale'; 'rejects layout-derived candidates missing a leaf PTY binding'.",
        "Terminal/runtime defining-owner cleanup retires complete parking timer, lifecycle, mocked close/disposal and render/flip/mount work-count cases under repository test policy. The retained watcher source has only two literal-oracle coverage decisions; the retained cold-parking hook source has only the layout-PTY exemption invalidation case. Lost alarms include cooldown/measure/pin wakeups, split exit/close attribution and cancellation, watcher disposal/restart, flood timer rearm, worktree verdict damping, and destroyed-transport cold restore. No equivalent replacement coverage or execution pass for the reduced cases is claimed; prior dated receipts retain their original scope.",
        "Audit 3318 reduces web-session-terminal-pending-handle-recovery.test.ts, intentionally retiring disconnected retry, two-authoritative-absence retirement, explicit close-record short circuit, older-host disconnected absence, positive published-presence protection and unpublished-frame no-count alarms. Remove only the disconnected-retry assertion alias; preserve transient-retry assertion and both unchanged active Electron receipts. The remaining absence-reset interleaving is narrower, not an equivalent replacement for these six removed cases. Historical receipts retain their original scope. No fresh runtime, host/PTY/network, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3362 retires the whole orphan-recovery adoption-regressions suite, including thrown-adoption/post-adoption malformed or unavailable retries, prior-binding preservation, projected sibling retirement merging and blocked local-close/group-move fencing. Its compound unit token, test-file entry and assertion reference are removed. Injected inventory/adoption projections did not demonstrate usable input delivery. Two unrelated macOS E2E receipts remain verbatim; no equivalent replacement or fresh runtime/PTY/provider/UI/mobile/mixed-version/cross-platform evidence is claimed.",
        "Audit3362 historical original commands object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/parking/output-watchers/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/layout/split/terminal-pane-split-request-routing.test.ts src/renderer/src/components/terminal-pane/parking/lifecycle/use-terminal-tab-cold-parking.test.ts src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts src/main/runtime/terminal/layout/orca-runtime-terminal-split-authority.test.ts src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-parked-leaf.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/hosted-terminals/recovery/web-session-terminal-orphan-recovery-regressions.test.ts src/renderer/src/runtime/hosted-terminals/recovery/adoption/web-session-terminal-orphan-recovery-adoption-regressions.test.ts src/renderer/src/runtime/hosted-terminals/recovery/panes/web-session-terminal-pending-handle-recovery.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot\"",
        "Audit3362 historical original testFiles object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n\"src/renderer/src/runtime/hosted-terminals/recovery/adoption/web-session-terminal-orphan-recovery-adoption-regressions.test.ts\"",
        "Audit3362 historical original assertionRefs object, preserved verbatim; retired source claims are not active evidence or replacement coverage:\n{\n          \"file\": \"src/renderer/src/runtime/hosted-terminals/recovery/adoption/web-session-terminal-orphan-recovery-adoption-regressions.test.ts\",\n          \"assertions\": [\n            \"retries a transient thrown adoption on an unchanged semantic frame\",\n            \"retains the client epoch and retries when the post-adoption list has $failure\",\n            \"preserves prior terminal bindings after a post-adoption $failure and retries\",\n            \"merges host-projected $verdict sibling state after adoption without treating pending as exited\",\n            \"does not apply an adoption result after the local tab closes while adoption is blocked\",\n            \"does not apply an adoption result after the local tab moves groups while adoption is blocked\"\n          ]\n        }",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. The paired serve-restart file loses only the expensive automation-run-ID restart case. Its original terminal journey remains byte-identical: daemon/fixture process identity survives replacement serve, keyboard/output/grid/history/checkpoint converge and authoritative close removes the binding. LAYOUT_OWNER_BUILD gates its pending-handle assertion. Existing dated receipt objects and assertion references retain their original terminal-journey scope and provide no fresh validation of the reduced file selector. All prior notes and archived receipts retain original scopes."
      ],
      "demotionRule": "Demote if a live parked/restarting PTY loses its exact graph leaf or verified viewer binding, a retired PTY remains published, multi-pane identity drifts, or either routed client round trip flakes without a diagnosed cause."
    },
    {
      "id": "agent-browser.owner-boundary-cleanup",
      "title": "Headless browser helpers retire with their owning page and runtime",
      "maturity": "experimental",
      "protection": "none",
      "owner": "browser-runtime",
      "layer": "electron-main-headless-browser-lifecycle",
      "surfaces": [
        "headless offscreen browser page close",
        "offscreen renderer destruction",
        "app quit",
        "headless serve SIGINT/SIGTERM"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "remote-runtime", "ssh", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2043: Remove the imported allowlist inventory examples described in the historical account below. This gate already has no active commands, testFiles, assertionRefs or evidenceRuns and protection remains none. No replacement coverage or fresh execution is claimed. Historical prior account (preserved verbatim): Audit1556 removes the whole mocked helper session lifecycle suite and reduces offscreen lifecycle and tab-routing suites. Mock helper argv/route/concurrency, private active state, explicit unregister ordering, standalone renderer-destroy notification and debugger-detach alarms are retired without equivalent replacement. Remaining offscreen cases prove same-ID replacement preservation and shutdown joining pending retirement against injected windows/manager/helper dependencies. The retained tab-routing case proves snapshot-reference provenance against injected helper replies. Reduced reliability commands have no fresh cohort/native receipt; this batch ran its ten retained authored cases plus two unchanged imported allowlist cases only. Historical pre-audit scope: The owner-boundary contract injects an isolated BrowserManager, offscreen WebContents, and AgentBrowserBridge. It proves explicit close removes the page from command routing before awaiting exact named-session retirement, runs retirement on unexpected renderer destruction, preserves unrelated pages, joins pending creation/retirement during shutdown, rejects command admission after terminal cleanup begins, retries Electron quit after a vetoed signal, preserves Windows shared-console graceful Ctrl-C, reserves the full renderer-acknowledgement and committed-teardown budgets before supervisor force-kill, bounds process-swap retirement to five seconds, and caps cleanup concurrency at four. A built-CLI macOS headless serve run used an isolated profile, folder workspace, socket directory, and port: exact PPID-1 helper/session identity disappeared within five seconds after page close and after Ctrl-C runtime shutdown, while an unrelated page survived close and reconnect. Linux cgroup and paired/SSH journeys remain gaps. Audit1379 changes src/main/browser/cdp/snapshots/snapshot-engine-iframe-sessions.test.ts (3 authored registrations removed; 0 retained); src/main/browser/client-hosts/file-transfers/browser-client-download-routing.test.ts (3 authored registrations removed; 4 retained). Intentional losses: Loses ref/string/Map.get-count projections; no real browser operation. Intentionally removes 3 authored registrations: 'cancels a client-hosted download whose owner cannot be resolved'; 'leaves ordinary browser guests on their desktop Downloads path'; 'stops routing to a composition once it starts closing'. Retained focused cases are not claimed as equivalent replacement for these losses. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1383: src/main/browser/guest-lifecycle/browser-guest-devtools-dock.test.ts reduced. Lose capture failure baseline and destroyed-host callback control. Fake Electron view models native lifecycle and custody; no native rendering/visible focus claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/browser/agent-browser/agent-browser-action-effects.test.ts reduced. No standalone baseline snapshot call-count alarm. src/main/browser/routing/partitions/browser-route-partition-stability.test.ts removed. Standalone assembled partition stability/separation/binding-count alarms across runtime/SSH/WSL/environment identity removed. No real browser cookie/session continuity or replacement equivalence is claimed. src/main/browser/element-grab/browser-grab-payload.test.ts reduced. Standalone annotation clamp/list-count/default preservation characterization removed. src/main/browser/cdp/input/guest-focused-frame-route.test.ts reduced. Attach-call count, default widget fallback and claimed detach-forgetting alarm removed; no actual Chromium frame/input delivery claimed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. src/main/browser/cdp/screencast/browser-screencast-live-frame-allocation.test.ts reduced. Retires captured PNG/JPEG twelve-frame digest/metadata/ack replay bundled with zero copied-byte instrumentation; surviving retry ownership witness is not claimed equivalent format or sequence coverage. src/main/browser/extensions/context-menus/browser-extension-context-menu-model.test.ts reduced. Toolbar-context constant membership, wrapper submenu structure and click-data property projection no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts removed. Loses file-channel negotiation refusal at the schema parse boundary; no replacement asserted. src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts removed. Loses original upload-error priority when cleanup also fails and staging-release alarm. src/main/browser/extensions/installation/browser-extension-install-store.test.ts reduced. Loses install-directory path escape refusal alarm from the unpinned exception case. src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts removed. Loses WSL deploy/rename/reimport cookie-jar identity helper alarms without actual page/storage attachment. src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts removed. Loses profile-stable versus profile-isolated host identity composition alarms. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1412: src/main/browser/extensions/native-messaging/browser-extension-native-host-process-backpressure.test.ts reduced. Loses synchronous host/global queue refusal, frame encoding and UTF8/body bounds at fake stdin, largest-stalled-host eviction/accounting, capacity completion and shutdown claim release alarms. The retained final-reply case does not establish outgoing pressure behavior. src/main/browser/cdp/input/browser-element-functions.test.ts removed. Loses independently fixed disabled/read-only/element-kind guard messages, number sanitization rollback, spinbutton targeting, focus hijack/replacement rejection, composed input event order and upload/selection behavior in happy-dom. No equivalent browser coverage is claimed. src/main/browser/extensions/permissions/browser-extension-settings-prompt-lifetime.test.ts reduced. Loses accepted-install continuation through renderer navigation while loading. The kept cancelled/retry path does not validate that exact ownership window. src/main/browser/cookies/client-route/browser-client-route-cookie-import.test.ts reduced. Loses no-route delegation/picker, failed-import source badge, compatible runtime-id success and manual/import destination argument wiring alarms. Retained refusal results do not prove cookie import or stored source updates. src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.",
      "motivatingLinks": [
        "https://linear.app/stably/issue/STA-5400",
        "https://github.com/stablyai/orca/issues/16367"
      ],
      "invariant": "For each Orca-owned page identity, after its owner closes or is destroyed and a five-second third-party shutdown grace expires, no live helper session named orca-tab-<pageId> may remain; unrelated live page identities must survive, and runtime quit must join the bounded cleanup attempt. The serve supervisor may force-kill only after the renderer-acknowledgement deadline, committed teardown deadline, and bounded scheduling margin have all elapsed.",
      "oracle": "Create two isolated offscreen pages and register their WebContents. Close one, block onPageClosed for its stable page ID, and require unregisterGuest to have already removed that page from command routing while the unrelated page remains live. Emit destroyed and require the same exact retirement. Race shutdown with creation, pending retirement, and process-swap destruction; require no replacement session or command after terminal cleanup starts, require shutdown to remain pending until retirement settles, require the swap close command to use the five-second cleanup timeout, and require at most four concurrent close commands. Deliver repeated signals and require every attempt to reach Electron quit; under Windows shared-console semantics require the child to handle Ctrl-C without an immediate child.kill. Advance the supervisor clock through the renderer-acknowledgement and committed teardown deadlines and require no SIGKILL until the bounded scheduling margin elapses. In direct built-CLI serve, inspect exact session/PID/socket identity plus RSS/fd inventory before close and after a five-second grace; reconnect between commands and stop via Ctrl-C. No process-name kill or global sweep is permitted.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 2,
        "scope": "bounded offscreen lifecycle contracts and bridge cleanup ordering"
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Fresh deterministic coverage has local candidate evidence only."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "The pristine current-main control failed explicit close, unexpected destruction, backend shutdown, pending creation, bounded concurrency, joined quit, and repeated-signal assertions; the candidate passed the byte-identical oracle. Disabling only process-swap cleanup timeout and terminal command admission failed 3 of 15 bridge lifecycle tests. Live candidate-with-signal-fix-disabled also retained exact helpers after Ctrl-C, while the final candidate removed them."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Cleanup is event-driven and exact-page scoped: no polling, process-name scan, idle timer, or new wire field. Owner and residual session drains cap close subprocess concurrency at four, sequence headless ownership cleanup before the residual bridge sweep, and reuse the existing bounded app teardown deadline."
      },
      "promotionCriteria": [
        "Run the same oracle on Linux headless serve with bundled agent-browser PID/session and RSS/fd inventory.",
        "Exercise runtime restart, transport loss, reconnect, concurrent tabs, and paired/SSH host ownership without cross-page cleanup.",
        "Collect repeated open/close/reconnect evidence showing bounded helper count and no stale PID-1-owned Orca identities."
      ],
      "knownGaps": [
        "Audit1556 demotes this gate to protection none after retiring its complete passed receipt. Selector and assertion inventory retained here as historical only; current retained tests remain in the unit suite. {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/agent-browser/agent-browser-bridge-tab-routing.test.ts src/main/startup/serve-signal-handlers.test.ts --maxWorkers=2\",\"pnpm exec vitest run --config config/vitest.config.ts src/main/browser src/main/updater/browser-sidecar-owner.test.ts\"],\"testFiles\":[\"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\"src/main/browser/agent-browser/agent-browser-bridge-tab-routing.test.ts\",\"src/main/startup/serve-signal-handlers.test.ts\",\"src/cli/runtime/serve-signal-exit-diagnostic.test.ts\"],\"assertionRefs\":[{\"file\":\"src/main/startup/serve-signal-handlers.test.ts\",\"assertions\":[\"every repeated serve signal retries Electron quit after a possible renderer veto\",\"SIGINT and SIGTERM listeners remain installed during quit draining\"]},{\"file\":\"src/cli/runtime/serve-signal-exit-diagnostic.test.ts\",\"assertions\":[\"serve supervisor force-kill grace covers renderer acknowledgement, committed teardown, and scheduling margin\",\"Windows shared-console Ctrl-C is not forwarded as an immediate child termination\"]},{\"file\":\"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\"assertions\":[\"same-ID replacement survives old window closure after awaited retirement\",\"shutdown joins owner retirement already started by unexpected renderer destruction\"]},{\"file\":\"src/main/browser/agent-browser/agent-browser-bridge-tab-routing.test.ts\",\"assertions\":[\"unpinned references from a different page snapshot are refused until current page is snapshotted\"]}]}",
        "Audit1556 removes the whole mocked helper session lifecycle suite and reduces offscreen lifecycle and tab-routing suites. Mock helper argv/route/concurrency, private active state, explicit unregister ordering, standalone renderer-destroy notification and debugger-detach alarms are retired without equivalent replacement. Remaining offscreen cases prove same-ID replacement preservation and shutdown joining pending retirement against injected windows/manager/helper dependencies. The retained tab-routing case proves snapshot-reference provenance against injected helper replies. Reduced reliability commands have no fresh cohort/native receipt; this batch ran its ten retained authored cases plus two unchanged imported allowlist cases only.",
        "Audit1556 retired assertion inventory; historical only: [{\"file\":\"src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts\",\"assertions\":[\"explicit close unregisters the page before awaiting exact owner cleanup while unrelated and same-ID replacement pages survive\",\"unexpected offscreen renderer destruction invokes and joins exact helper-owner cleanup\",\"backend shutdown joins every pending owner cleanup with concurrency capped at four\"]},{\"file\":\"src/main/browser/agent-browser/agent-browser-bridge-session-lifecycle.test.ts\",\"assertions\":[\"owner cleanup uses a five-second close-command timeout\",\"process-swap retirement uses the same five-second cleanup timeout\",\"runtime shutdown includes sessions whose creation is still pending\",\"runtime shutdown rejects late command and replacement-session admission\",\"runtime-wide helper cleanup concurrency is capped at four\"]},{\"file\":\"src/main/browser/agent-browser/agent-browser-bridge-tab-routing.test.ts\",\"assertions\":[\"closing a tab retires the exact named agent-browser session\"]}]",
        "Audit1556 retired complete execution receipts; original fields unchanged: [{\"date\":\"2026-10-06\",\"runner\":\"local\",\"platform\":\"macos\",\"result\":\"passed\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts src/main/browser/offscreen-browser-backend-lifecycle.test.ts src/main/browser/agent-browser-bridge-session-lifecycle.test.ts src/main/browser/agent-browser-bridge-tab-routing.test.ts src/main/startup/serve-signal-handlers.test.ts --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts src/main/browser/agent-browser/agent-browser-bridge-session-lifecycle.test.ts src/main/browser/agent-browser/agent-browser-bridge-tab-routing.test.ts src/main/startup/serve-signal-handlers.test.ts --maxWorkers=2\",\"durationSeconds\":2.546,\"summary\":\"The retained behavioral cohort passed 58 tests after removing source-only ordering tests. Historical pre-removal receipts are preserved verbatim with their originally executed commands: [{\\\"date\\\":\\\"2026-08-26\\\",\\\"runner\\\":\\\"local\\\",\\\"platform\\\":\\\"macos\\\",\\\"result\\\":\\\"passed\\\",\\\"command\\\":\\\"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts src/main/browser/offscreen-browser-backend-lifecycle.test.ts src/main/browser/agent-browser-bridge-session-lifecycle.test.ts src/main/browser/agent-browser-bridge-tab-routing.test.ts src/main/startup/serve-signal-handlers.test.ts src/main/startup/desktop-startup-ordering.test.ts\\\",\\\"durationSeconds\\\":0.44,\\\"summary\\\":\\\"Candidate passed 63 lifecycle, bridge, routing, signal, and quit-order tests plus 1,469 browser tests. The production-reverted control was red; disabling the final swap-timeout/admission controls failed 3 of 15 bridge lifecycle tests; removing the pending-retirement join, page-routing fence, repeat-signal behavior, or Windows shared-console guard failed its exact focused oracle. Setting the supervisor scheduling margin to zero reproduced SIGKILL at the combined 30-second renderer-acknowledgement and teardown boundary. Direct built-CLI serve observed exact PPID-1 helpers at 10-11 MiB RSS and 16-18 fd rows. Closing one page removed only its helper/session within five seconds while the other page survived reconnect. With the signal fix disabled, Ctrl-C left exact helpers alive after the listener exited; the final candidate emptied session inventory and removed app/helper PIDs and port within five seconds.\\\"}] No new native desktop or hosted run is claimed.\"}]",
        "No 64 GiB Linux cgroup stress was manufactured; the reported production incident remains un-soaked.",
        "The real Electron headless serve oracle ran on macOS; physical Linux/SSH/WSL and paired-client journeys remain unvalidated.",
        "A close-command timeout or error is treated as best-effort and does not escalate to a process kill; helper disappearance on that failure path remains unverifiable without exact PID ownership.",
        "Four-way close batches remain bounded but can exceed the 20-second app quit barrier above 16 worst-case five-second retirements.",
        "The patch does not add startup stale-process recovery or an idle timeout; those require an exact persisted ownership ledger and are intentionally out of scope.",
        "Audit1379 changes src/main/browser/cdp/snapshots/snapshot-engine-iframe-sessions.test.ts (3 authored registrations removed; 0 retained); src/main/browser/client-hosts/file-transfers/browser-client-download-routing.test.ts (3 authored registrations removed; 4 retained). Intentional losses: Loses ref/string/Map.get-count projections; no real browser operation. Intentionally removes 3 authored registrations: 'cancels a client-hosted download whose owner cannot be resolved'; 'leaves ordinary browser guests on their desktop Downloads path'; 'stops routing to a composition once it starts closing'. Retained focused cases are not claimed as equivalent replacement for these losses. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1383: src/main/browser/guest-lifecycle/browser-guest-devtools-dock.test.ts reduced. Lose capture failure baseline and destroyed-host callback control. Fake Electron view models native lifecycle and custody; no native rendering/visible focus claimed. No equivalent replacement coverage is claimed.",
        "Audit1390: src/main/browser/agent-browser/agent-browser-action-effects.test.ts reduced. No standalone baseline snapshot call-count alarm. src/main/browser/routing/partitions/browser-route-partition-stability.test.ts removed. Standalone assembled partition stability/separation/binding-count alarms across runtime/SSH/WSL/environment identity removed. No real browser cookie/session continuity or replacement equivalence is claimed. src/main/browser/element-grab/browser-grab-payload.test.ts reduced. Standalone annotation clamp/list-count/default preservation characterization removed. src/main/browser/cdp/input/guest-focused-frame-route.test.ts reduced. Attach-call count, default widget fallback and claimed detach-forgetting alarm removed; no actual Chromium frame/input delivery claimed. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. src/main/browser/cdp/screencast/browser-screencast-live-frame-allocation.test.ts reduced. Retires captured PNG/JPEG twelve-frame digest/metadata/ack replay bundled with zero copied-byte instrumentation; surviving retry ownership witness is not claimed equivalent format or sequence coverage. src/main/browser/extensions/context-menus/browser-extension-context-menu-model.test.ts reduced. Toolbar-context constant membership, wrapper submenu structure and click-data property projection no longer independently asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts removed. Loses file-channel negotiation refusal at the schema parse boundary; no replacement asserted. src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts removed. Loses original upload-error priority when cleanup also fails and staging-release alarm. src/main/browser/extensions/installation/browser-extension-install-store.test.ts reduced. Loses install-directory path escape refusal alarm from the unpinned exception case. src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts removed. Loses WSL deploy/rename/reimport cookie-jar identity helper alarms without actual page/storage attachment. src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts removed. Loses profile-stable versus profile-isolated host identity composition alarms. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1412: src/main/browser/extensions/native-messaging/browser-extension-native-host-process-backpressure.test.ts reduced. Loses synchronous host/global queue refusal, frame encoding and UTF8/body bounds at fake stdin, largest-stalled-host eviction/accounting, capacity completion and shutdown claim release alarms. The retained final-reply case does not establish outgoing pressure behavior. src/main/browser/cdp/input/browser-element-functions.test.ts removed. Loses independently fixed disabled/read-only/element-kind guard messages, number sanitization rollback, spinbutton targeting, focus hijack/replacement rejection, composed input event order and upload/selection behavior in happy-dom. No equivalent browser coverage is claimed. src/main/browser/extensions/permissions/browser-extension-settings-prompt-lifetime.test.ts reduced. Loses accepted-install continuation through renderer navigation while loading. The kept cancelled/retry path does not validate that exact ownership window. src/main/browser/cookies/client-route/browser-client-route-cookie-import.test.ts reduced. Loses no-route delegation/picker, failed-import source badge, compatible runtime-id success and manual/import destination argument wiring alarms. Retained refusal results do not prove cookie import or stored source updates. src/main/browser/guest-lifecycle/manager/browser-manager-guest-policy-profile.test.ts removed. Loses workspace-document in-grant navigation/popup refusal, cleanup/re-attach, cross-registry guest authorization and browsing-map separation alarms. No equivalent browser policy coverage is claimed. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit2043: Remove the imported allowlist inventory examples described in the historical account below. This gate already has no active commands, testFiles, assertionRefs or evidenceRuns and protection remains none. No replacement coverage or fresh execution is claimed."
      ],
      "demotionRule": "Demote if a closed or destroyed page leaves its exact named helper session, if quit can exit before helper retirement settles, if unrelated live pages are retired, or if cleanup regresses to a global process-name kill or timer-only sweep."
    },
    {
      "id": "terminal-session.remote-pane-layout-retry",
      "title": "Remote pane layouts retry identical state after reconnect",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-layout-sync",
      "layer": "renderer-paired-runtime-layout",
      "surfaces": ["paired terminal split layout", "pane title", "runtime reconnect"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["paired-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Pure contracts cover identity-equal local write bailouts and remote push deduplication, while a headless-host paired Electron journey proves that an identical local layout is retried after a failed disconnected push and becomes visible to an independent observer. Audit1400: src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/12420"],
      "invariant": "Identity-equal pane layout writes avoid local churn but never suppress a remote retry whose prior push failed; reconnecting and repeating the same layout persists it on the host and publishes it to other paired clients.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Disconnect a paired client, change a pane title, and observe the failed host push while local state retains the layout. Reconnect without remounting, submit the identical title again, and require the headless host plus a second paired observer to receive it.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 90,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: The existing paired sentinel is newly source-routed and has no route-specific CI soak history."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: The affected implementation cached the disconnected layout before host acknowledgment and suppressed the identical retry; the merged oracle keeps only successful remote pushes deduplicated and the observer receives the retried title."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: Successful identity-equal writes remain O(1) bailouts; one failed remote push permits one later identical retry, with no polling, timer, provider scan, subprocess, or new wire field."
      },
      "promotionCriteria": [
        "Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
        "Collect Linux and Windows paired-runtime reconnect evidence.",
        "Keep local identity bailouts and failed-push retry ownership green."
      ],
      "knownGaps": [
        "The paired reconnect journey has only local macOS evidence.",
        "The sentinel changes a pane title within an existing layout; concurrent split and close conflicts remain separate coverage.",
        "Audit1400: src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts reduced. Removes three no-op/work-count registrations; retains externally observed ownership consistency. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-10-09\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts --reporter=dot\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.9345390829999998,\n          \"summary\": \"The current retained gate command passed 32 tests across 2 files. Historical pre-consolidation receipts are preserved verbatim with their originally executed commands: [{\\\"date\\\":\\\"2026-08-23\\\",\\\"runner\\\":\\\"local\\\",\\\"platform\\\":\\\"macos\\\",\\\"result\\\":\\\"passed\\\",\\\"command\\\":\\\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts --reporter=dot\\\",\\\"durationSeconds\\\":5,\\\"summary\\\":\\\"Two focused files passed 20 remote-push and identity-bailout contracts.\\\"}] No new E2E or hosted run is claimed.\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"paired-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts\",\n    \"assertions\": [\n      \"only successfully pushed layouts deduplicate later remote writes\"\n    ]\n  },\n  {\n    \"file\": \"tests/e2e/paired-remote-pane-layout-retry.spec.ts\",\n    \"assertions\": [\n      \"an identical layout retries after reconnect and reaches a second paired observer\"\n    ]\n  }\n]",
        "Audit1400 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n  {\n    \"file\": \"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\",\n    \"assertions\": [\n      \"identity-equal layout and timer writes avoid redundant local updates\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts\",\n          \"assertions\": [\"only successfully pushed layouts deduplicate later remote writes\"]\n        },\n        {\n          \"file\": \"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\",\n          \"assertions\": [\"identity-equal layout and timer writes avoid redundant local updates\"]\n        },\n        {\n          \"file\": \"tests/e2e/paired-remote-pane-layout-retry.spec.ts\",\n          \"assertions\": [\n            \"an identical layout retries after reconnect and reaches a second paired observer\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts --reporter=dot\",\"pnpm exec playwright test tests/e2e/paired-remote-pane-layout-retry.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1\"],\"testFiles\":[\"src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts\",\"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts\",\"tests/e2e/paired-remote-pane-layout-retry.spec.ts\"]}"
      ],
      "demotionRule": "Demote if a failed push suppresses an identical retry, a successful equal write resumes redundant churn, or the routed observer journey flakes without a diagnosed cause."
    },
    {
      "id": "ssh.docker-recovery-and-resource-lifecycle",
      "title": "Docker SSH reconnect, host faults, listing and watcher lifecycle",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "electron-docker-ssh",
      "surfaces": [
        "SSH terminal recovery",
        "SSH remote resource ownership",
        "remote file listing",
        "remote explorer watcher recovery",
        "Electron test process cleanup"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["ssh"],
      "coveredPlatforms": ["macos", "linux"],
      "coveredProviders": ["ssh"],
      "coverageNotes": "A macOS Electron client drives a Linux Docker SSH execution host. The six-spec suite passed ten enabled cases with clean worker exit (5.2m). The formerly skipped frozen-host input case now waits for recovered authority before sending input and passed four separate executions (one initial and three repetitions). The existing flooded-shell fixme remains an explicitly reproduced application gap. The bulk-open freeze reproduction runs in Linux headed CI with SwiftShader on Xvfb: headless Linux schedules idle animation frames about 1s apart, invalidating the foreground interaction measurement. Original uninstrumented five-pane workload passed all ten repetitions with zero retries/skips in 6.6m; bulk-open lag 79.3–147.8ms and interaction 127.1–155.9ms, unchanged 2500ms/5000ms budgets. Run 34037669843, head f25eab3fd7d723509ced026633f80b193a139b76, excludes unmerged replay-input application fix #19075. Deterministic remote Codex fixture validation passed three normal restores and three forced reconnects with zero retries on merged main plus the replay probe correction (run 34050117471). The original forced-reconnect probe missed nonempty replay returned in pty:spawn reattach replies. Routine coverage now includes both modes by default; real Codex service execution remains opt-in. The added five-pane input spec passed in Linux CI run 34033353595, and diagnostic run 34034754815 reproduced real input loss during scrollback replay; application fix #19075 (98b0c329ff3) has since merged and this spec now guards it.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/issues/18018",
        "https://github.com/stablyai/orca/pull/18546",
        "https://github.com/stablyai/orca/issues/12547",
        "https://github.com/stablyai/orca/issues/16764",
        "https://github.com/stablyai/orca/actions/runs/34037450427",
        "https://github.com/stablyai/orca/actions/runs/34037669843",
        "https://github.com/stablyai/orca/actions/runs/34050117471"
      ],
      "invariant": "Transport loss and frozen-host silence must preserve the remote session; host relay loss may rebind a pane without accumulating reattachable leases. Reconnects must preserve usable terminal content, bounded PTYs/fds/processes, complete large listings, and independently recoverable watcher processes. Electron test shutdown must release inherited pipes after confirmed root exit without closing live-process pipes.",
      "oracle": "Poll a changed connected SSH authority after injected faults, then require terminal output and appropriate PTY identity. Read remote process/fd state, listFiles replies, and rendered explorer rows. Resolve Playwright cleanup only after the root process exits and its inherited pipes close; live-process pipes remain untouched.",
      "commands": [
        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/helpers/electron-process-shutdown.unit.test.ts"
      ],
      "testFiles": ["tests/e2e/helpers/electron-process-shutdown.unit.test.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/helpers/electron-process-shutdown.unit.test.ts",
          "assertions": [
            "releases inherited pipes after confirmed exit, including prior exit",
            "retains live-process pipes on shutdown timeout"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-05",
          "runner": "local",
          "platform": "macos",
          "result": "passed",
          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/helpers/electron-process-shutdown.unit.test.ts",
          "durationSeconds": 0.168,
          "summary": "All three shutdown regression tests passed; disabling pipe release fails the first two by timeout. Two half-open Electron repetitions separately passed in 1.7m without worker teardown timeout."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 420,
        "scope": "per Electron Docker test; measured suite p95 and CI soak not yet established"
      },
      "flakeHistory": {
        "status": "flaky",
        "evidence": "Baseline: ten enabled tests passed, two fixme skipped, worker teardown timed out (7.3m). After pipe cleanup: ten passed and worker exited cleanly (5.2m); two half-open repeats passed (1.7m). The formerly skipped thaw-input case failed before its recovered-authority wait and passed 1+3 executions afterward (56.9s + 2.6m). Flood failed both its original input oracle and a strengthened producer-completion oracle after recovery. Five-pane input diagnostics additionally failed 1/5 in run 34034754815: the intended focused PTY emitted the full input, the replay guard discarded 31 characters, and the remote ACK contained exactly the remaining suffix. PR #19075 addresses that application bug; passing repetitions alone do not establish its resolution."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Disabling exited-process pipe release causes two shutdown contract tests to time out; restoring it passes 3/3. Baseline Docker worker teardown failed; final six-spec enabled run and half-open repeats exit successfully. Frozen-host input fails without the post-thaw recovered-authority wait and passes four runs with it. Full product fault/recovery mutation coverage and CI history remain missing."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Test-only bounded pipe destruction and authority polling; no production polling, subprocesses, or runtime work added. Remote resources are counted instead of using wall-clock leak thresholds."
      },
      "promotionCriteria": [
        "Require complete six-spec repeat runs with clean worker shutdown.",
        "Resolve the remaining #18018 flooded-shell reproduction and remove its fixme marker.",
        "Collect CI runtime and flake history plus product red/green evidence before blocking."
      ],
      "knownGaps": [
        "Five-pane simultaneous flood input was reproduced as a real application bug in run 34034754815 (replay discarded the first 31 characters of correctly focused keyboard input); fix #19075 (98b0c329ff3) merged and the spec now guards it, but the retries: 0 Docker SSH lane is the only repetition evidence against the merged fix so far. Freeze performance coverage was restored separately in #19081, with its isolated headless timer-lag outlier still documented.",
        "The disconnected 48MB flood still loses its relay channel: original post-flood input marker failed in 60s, and waiting for the finite producer completion marker failed in 120s. It remains an explicit #18018 fixme reproduction; frozen-host input is re-enabled after four successful runs.",
        "Linux headed CI covers the bulk-open freeze reproduction; Windows clients, WSL, folder workspaces, paired runtimes and live agent CLIs are not covered by that result.",
        "Some legacy assertions inspect terminal serialization or backing state rather than rendered DOM; no blanket visual coverage claim.",
        "No p95 CI history or full product mutation proof.",
        "One headless bulk-open probe reached 6478.6ms in run 34035957303; animation-frame scheduling explains the consistent interaction failures, but does not directly explain that isolated timer-lag outlier. Long-term headed CI soak remains outstanding.",
        "Codex replay artifact evidence uses a deterministic remote TUI on Linux CI; real-service, macOS/Windows clients and cross-version replay remain separate coverage gaps."
      ],
      "demotionRule": "Keep experimental while any recovery reproduction fails or any teardown, identity, resource-count, or rendered oracle flakes; never promote by extending sleeps or retries."
    },
    {
      "id": "terminal.windows-wsl-launch-and-paste",
      "title": "Real WSL terminal agent launch and paste ownership",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-runtime",
      "layer": "electron-windows-wsl",
      "surfaces": ["agent tab launch", "keyboard paste", "terminal runtime retention"],
      "platforms": ["windows"],
      "providers": ["wsl1", "wsl2"],
      "coveredPlatforms": ["windows"],
      "coveredProviders": ["wsl1"],
      "coverageNotes": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Remove synthetic WSL participation-verifier tests. The real WSL1 receipt and partial protection remain; WSL2 is still untested. Historical scope before this audit: Real WSL1 coverage: three scenarios each passed three times with no skips or retries; exact JSON report verified. Latest PR routing and installer-checksum follow-ups await CI. WSL2 remains untested.",
      "motivatingLinks": ["https://github.com/stablyai/orca/actions/runs/34030832614"],
      "invariant": "An agent launched into WSL runs in the guest; keyboard paste reaches exactly one owning PTY and preserves Linux content even after the default shell changes.",
      "oracle": "Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Run the existing real WSL launch and two paste cases three times; require nine passes and zero skipped, unexpected, or flaky results in the Playwright JSON report.",
      "commands": [
        "gh workflow run windows-wsl-e2e.yml",
        "pnpm exec playwright test tests/e2e/golden-tab-bar-agent-launch.spec.ts tests/e2e/terminal-windows-shell-paste-ownership.spec.ts --config tests/playwright.config.ts --project=electron-headless --workers=1",
        "gh run view 34031806291 --log"
      ],
      "testFiles": [
        "tests/e2e/golden-tab-bar-agent-launch.spec.ts",
        "tests/e2e/terminal-windows-shell-paste-ownership.spec.ts"
      ],
      "assertionRefs": [
        {
          "file": "tests/e2e/golden-tab-bar-agent-launch.spec.ts",
          "assertions": ["requires a distro-only marker from the launched agent"]
        },
        {
          "file": "tests/e2e/terminal-windows-shell-paste-ownership.spec.ts",
          "assertions": ["retains WSL paste ownership after changing the default shell"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-06",
          "runner": "ci",
          "platform": "windows",
          "result": "passed",
          "command": "gh run view 34031806291 --log",
          "durationSeconds": 210,
          "summary": "Immutable run34031806291 at92fc5152: WSL1 launch3 and paste6 passed after reader-readiness correction; named-scenario verifier accepted actual JSON report with0skips0retries. Command retrieves recorded evidence; workflow_dispatch command above reruns current coverage."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 1800,
        "scope": "CI job timeout; measured p95 is not established"
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Initial permanent-lane diagnostic8passed1failed on missing PTY before changing settings. After requiring guest-reader readiness before mutation, run34031806291 passed9/9. Two earlier setup validations also passed9/9. Long-term CI history remains missing."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Verifier rejects actual8pass1fail CI report and accepts actual9pass report. Unit contracts reject skips, missing or substituted scenarios and retried passes. No full application fault-mutation proof."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "CI-only provisioning and routing; no application runtime changes."
      },
      "promotionCriteria": [
        "Require all nine real WSL executions on the final workflow head.",
        "Demonstrate missing or skipped WSL execution fails participation.",
        "Collect repeated CI history before adding this experimental lane to required verification."
      ],
      "knownGaps": [
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches tests/e2e/terminal-windows-shell-paste-ownership.spec.ts. Unresolved local/computed edges remain explicit debt. Retire the removed WSL exact-Linux-content alias; complete original assertionRefs preserved as history only: [{\"file\":\"tests/e2e/golden-tab-bar-agent-launch.spec.ts\",\"assertions\":[\"requires a distro-only marker from the launched agent\"]},{\"file\":\"tests/e2e/terminal-windows-shell-paste-ownership.spec.ts\",\"assertions\":[\"requires exact Linux pasted content and exactly one PTY write\",\"retains WSL paste ownership after changing the default shell\"]}].",
        "Remove synthetic WSL participation-verifier tests. The real WSL1 receipt and partial protection remain; WSL2 is still untested.",
        "WSL2 is not provisioned.",
        "No SSH, folder-only workspace, packaged mixed-version, or live-service claim.",
        "The new PR lane is outside verify until reliability is established."
      ],
      "demotionRule": "Keep experimental if provisioning or an execution flakes; never promote by skipping a case, raising timeouts, or retrying until green."
    },
    {
      "id": "browser.packaged-mixed-version-placement",
      "title": "Packaged browser placement across versions",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "browser-runtime",
      "layer": "electron-packaged",
      "surfaces": ["paired browser placement"],
      "platforms": ["linux", "macos", "windows"],
      "providers": ["paired-runtime"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": ["paired-runtime"],
      "coverageNotes": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1579 removes workflow/manifest/regex/private binary-header and diagnostic metric inventories, fixture selectors, injected forwarding/platform/signature/process examples, unproven overlap and internal churn counters without equivalent replacement coverage. Retains actual Git trust/diffs; filesystem hash/ELF-region/native discovery; child CLI module repair; compiler/lock/publication/rollback and synthetic Electron install/cache ownership; executable shell quoting/exit; controlled notary/timer cleanup; local patched extractor file/AST freshness; real Chromium/WebKit CSP/sandbox/HTTPS image/referrer/link/preservation controls under parsed Android headers. Five unchanged setup-pnpm/VM request-cleanup definitions reviewed and not rerun. GitHub, installer/archive, OS metric, client, native delegate, compressor, builder and Apple boundaries injected or absent where recorded. No actual native PTY, shipped full/native app, real Actions/cache/npm signature authority, downloaded Electron archive, real objdump/linker/native CLI/AppImage, signing/NSIS/notary/upload/updater or live freeze proof. Historical scope before this audit: Published Linux 1.4.188 desktop against current source in both directions; scheduled weekly and manually runnable. No required PR check.",
      "motivatingLinks": ["https://github.com/stablyai/orca/actions/runs/34069063016"],
      "invariant": "A paired client and host without client-hosted browser capabilities retain server-hosted browser placement across supported version skew.",
      "oracle": "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms. Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup. Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms. Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget. Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed. Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed. Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes. Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope. Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope. Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope. Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope. Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed. Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed. Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed. Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed. Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical. Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims. Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands. Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired. Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed. Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed. Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed. Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed. Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed. Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction. Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery. Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms. Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed. Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked. Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed. Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation. Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed. Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed. Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed. Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed. Audit2432: The broad unit command loses the isolated BranchPicker open-change notification sample. Its unique true/false callback alarm is intentionally retired; reopening/status-refresh behavior was not exercised. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2425: The broad unit command loses the workspace-copy-status supplied readError forwarding sample. It did not exercise the branch-switch blocking promised by its title. This alarm is intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2417: The broad unit command loses two ordinary clean Git cherry-pick/revert success samples and two terminal startup foreground-read work-budget samples. These unique alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2412: The broad unit command loses the whole six-case fake-React-hook scroll-anchor suite, two generic draft-retention samples, a simple new-agent order sample, a real history-publication batching-count sample, an unmounted handoff abort/timer sample and three basic WSL preview/error samples. These alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2404: The broad unit command loses the standalone share-name lookup 503 propagation suite, initial deletion placement-kind sample, direct changed-mtime stale sample, first-pass rollback existence example and abandoned-preparation directory sample. These exact alarms are intentionally retired without equivalent replacement or fresh validation of the reduced selector. Audit2397 review amendment: The broad unit command loses three standalone suites, two partial-case definitions and two URL table rows across package/download/placement tests. Keep initial wrong-port authorization, modified independent-copy digest refusal and abort-after-begin cancellation dispatch. The remaining alarms are deliberately retired; no equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2393 current-parent refresh2401: Remove the basic skill-install service alias sample and original public managed-remove receiptless refusal case. Preserve the upstream request ownership suite and transaction interruption coverage. No equivalent complete replacement or fresh validation of the reduced selector is claimed. Audit2389: The broad unit command loses the missing-preview suite, plain-global destination sample and prepublished-receipt recovery example. No equivalent replacement or fresh validation of the reduced selector is claimed. Audit2385: The broad unit command loses four authored walker/staging/protocol examples (six expanded cases); no equivalent replacement or fresh validation is claimed for the reduced suite. Audit2383: The unscoped Vitest command no longer includes the removed Antigravity catalogue suite; its exact provider-root/owner example has no equivalent replacement or fresh validation claim. Audit2377/2381: The unscoped Vitest command includes the reduced bundled-skill and native-discovery suites; the eight removed backup/legacy/catalogue/symlink/SSH-builder examples have no replacement-equivalence or fresh validation claim here. Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Require both existing named browser placement scenarios to pass three times with one attempt, zero skips, zero failures, and no report errors.",
      "commands": [
        "gh workflow run packaged-browser-e2e.yml",
        "pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project=electron-headless --workers=1 --repeat-each=3 --retries=0",
        "gh run view 34069063016 --log",
        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=2 --reporter=dot"
      ],
      "testFiles": ["tests/e2e/packaged-mixed-version-browser-placement.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/packaged-mixed-version-browser-placement.spec.ts",
          "assertions": [
            "old client and old host lack client-host and browser-tunnel capabilities",
            "browser contents remain owned by the server and the expected snapshot marker is readable"
          ]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-07",
          "runner": "ci",
          "platform": "linux",
          "result": "passed",
          "command": "gh run view 34069063016 --log",
          "durationSeconds": 120,
          "summary": "Both unmodified compatibility cases passed three times at 5a99f935 with published1.4.188 and main f7d52160162; retries0. Final workflow34069429156 also passed6/6; its downloaded JSON passed the same participation verifier."
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 1500,
        "scope": "CI job timeout; not a measured p95"
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Initial executable discovery matched CLI and desktop and was corrected before any tests ran. Corrected baseline2/2 and repeat6/6 pass."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Participation unit tests reject missing and retried scenarios; no application mutation proof. On 2026-10-06, the retained behavioral unit command \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts config/scripts/verify-packaged-browser-participation.test.mjs --maxWorkers=2 --reporter=dot\" passed 8 tests locally on macOS in 0.546 seconds. This checks the portable startup/participation verifier only; no new Linux native, packaged, desktop, or hosted qualification is claimed."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "Compatibility assertions, not a performance benchmark."
      },
      "promotionCriteria": [
        "Final workflow JSON report proves all six executions.",
        "Collect repeated scheduled history before making this required."
      ],
      "knownGaps": [
        "Launch direct-owner cleanup current scope: This gate’s unfiltered unit command now selects a suite reduced by 82 whole registrations  / 159 potential table examples in 10 whole test Programs, including 8 registrations / 15 examples from five once-registered create-message factory closures. Lost alarms include frozen first-message/options and legacy-host fallback; distinct actions and redelivery; uncertain/refused/reloaded input custody, Retry and late proof; rich prompt/attachment upload Stop/close and handback; ordinary draft/editor/IME/StrictMode lifetime and accepted topology; provisional fallback tab placement/group/pin/order and rich worktree handoff. Four whole consent/resume-identity cases remain in two Programs; they do not replace these alarms. This entry governs current reduced-unit scope and qualifies any broader implication of unchanged oracle/coverageNotes history. Entire dated evidenceRuns, original commands/currentCommand values, counts/results and existing history retain their original scopes only; no fresh execution, transferred pass, replacement equivalence or prior upstream-removal credit is claimed.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/persistence/worktree-sort-order-write.test.ts: re-ranks every writable row when a blocked row sits in the requested order. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts: continues skill management after startup recovery fails. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts: sizes a slow high-latency link near twice its bandwidth-delay product; never paces a LAN, even when its client parses slowly; never paces a fast link; returns to legacy windows when the path RTT jumps. src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts: steps down the row ladder when history is over the byte budget; tries the larger first row count, then the usual ladder within the same byte budget. src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts: returns unknown when route inspection fails or emits malformed data; does not inspect routes outside Windows. src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts: is refused to a paired %s client; reports a failed widening instead of advertising an unreachable address. src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts: reports exited only when the owning runtime completes the exit waiter; reports unverifiable when the runtime cannot observe the exit waiter; reports unverifiable when a disconnected PTY resolves with unknown liveness. src/main/runtime/session-graph/headless-runtime-graph.spec.ts: lets a session tab inventory settle on a host no renderer publishes for. src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts: remove only literal registration import/call pairs import { registerHeadlessRuntimeGraphTests } from './headless-runtime-graph.spec', registerHeadlessRuntimeGraphTests(); no additional authored credit. src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts: bumps the stored snapshot version only when the title changes. src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts: keeps the healthy aggregate verification and delayed physical exit behavior; uses a stamped exit for the incarnation that was actually being closed. src/main/runtime/terminal/identity/terminal-identity-probe.test.ts: answers live for a structured worker without touching the PTY graph; answers live for a PTY handle the runtime still holds; runs the full leaf check for a handle with no live PTY; answers not-live for a stale handle; propagates \"could not look\" rather than reporting it as a dead handle. src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts: names the tab in main’s layout through terminal.rename; takes a window-style layout.apply close as already stopped, so the terminal runs on. src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts: retains no lifecycle generation after a spawn/exit cycle. src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts: reads a freshly spawned terminal as used once a user opens its tab, not on a probe; keeps the open mark on the process a user open starts. src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts: from a desktop window that mounts both panes; from a server with no window. src/main/runtime/terminal/surface/workspace-layout-projection.test.ts: carries views for a partition that holds none yet. src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts: releases a signalled exit-waiter when the signal aborts. src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts: selects a local hook status for a local pane. src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts: keeps the footer and the bare caret on screen mid-turn; %s: the screen alone reads ready during %s. src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts: uses per-launch arguments and preserves launch telemetry; attributes a startup agent whose caller named no surface as unknown; launches %s bare for an absent or blank prompt; attributes a %s draft launch named %s as %s; merges an automation's extras over the host defaults; threads worktree-create extras into the startup build; returns an enabled requested agent without detecting; returns the default when nothing was requested; detects instead of using the default when the requested agent is disabled; starts no agent when the default is blank; detects an enabled agent on this host when nothing usable was named; starts no agent when detection finds none. src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts: pastes and submits through composer readiness, never typing raw input; types the follow-up on WSL or SSH-to-Windows once the agent is in front, as before; cleans up the deadline when the composer was already captured; a draft that is not submitted is pasted on the box cursor, as before; takes the box after the grace when the row never comes, whatever repaints; takes the box at the deadline when the grace would outlast the budget; lets a dialog on screen veto a grace; refuses the deadline inside a pending grace while a shell is in front; takes the box at the deadline inside a pending grace with the agent in front; takes the box at the deadline after a refused grace once the agent is in front. src/main/skills/skill-install-transaction.test.ts: installs, previews unchanged bytes, and updates a clean receipt-owned skill; preserves the old version after a %s filesystem failure. src/main/speech/model-manager-download-resume.test.ts: requests the remaining bytes when a clean range response ends before the file total; bounds a server that advances by pathologically tiny segments forever. src/main/ssh/config/ssh-config-parser.test.ts: parses a basic host block; parses multiple host blocks; skips wildcard-only Host entries; skips Host entries with only pattern characters; parses IdentityFile with ~ expansion; parses Windows-style IdentityFile with ~ expansion; parses quoted scalar values like OpenSSH; parses equals-form scalar directives; parses IdentityAgent with ~ expansion; parses IdentitiesOnly; parses GSSAPIAuthentication; keeps the first GSSAPIAuthentication value like OpenSSH; parses ProxyCommand, ProxyUseFdpass, and ProxyJump; ignores comments and blank lines; handles case-insensitive keywords; stops current block on Match directive; returns empty array for empty input; creates one parsed host per concrete alias on a multi-pattern Host line; applies identity agent settings to every concrete alias on a multi-pattern Host line; defaults port to 22 for invalid port values; converts hosts to SshTarget objects; uses host alias as hostname when HostName is missing; skips hosts that are already imported; defaults username to empty string when not specified; carries through identityFile, identityAgent, identitiesOnly, proxyCommand, and jumpHost; carries through gssapiAuthentication; imports duplicate aliases only once and keeps the first concrete host; maps hosts for the picker and flags aliases already in Orca; de-dupes aliases and defaults missing fields; parses hostname, user, port from ssh -G output; collects multiple identity files; parses forwardagent yes; defaults port to 22 when missing; returns empty hostname when missing; returns undefined user when missing; handles empty output; skips lines without spaces; parses proxycommand and filters \"none\"; parses proxyusefdpass yes; parses proxyjump and filters \"none\"; handles ~ expansion in identity file paths; handles Windows-style ~ expansion in identity file paths; parses identityagent with ~ expansion; preserves identityagent none so auth can disable agent fallback; parses identitiesonly yes; parses gssapiauthentication; parses controlmaster options and filters controlpath none. src/main/ssh/config/ssh-known-hosts-source.test.ts: splits the space-separated list ssh -G prints on one line; expands ~ in a reported path; keeps a double-quoted path containing spaces whole; falls back to the default files when ssh -G reported nothing; drops an explicit none without falling back to the defaults; splits both known_hosts lists on one line each; reads StrictHostKeyChecking, including accept-new; reads HostKeyAlias and prefers it for the lookup; reads the non-default port; reports that the lookup came from an alias, so the port is not appended; reports no alias when the dialed host is used; unions the entries of every file; skips a path that is a directory; returns nothing when no file can be read; reports nothing unreadable when every file parses; does not count an empty file as unreadable; prefers HostKeyAlias over the resolved hostname; uses the dialed host, because a resolved hostname can just echo the label; still prefers an explicit HostKeyAlias over the dialed host; falls back to the dialed host when nothing was resolved; is rejoined when the split fragments resolve to nothing; leaves a single unresolvable path alone rather than inventing one; expands the __PROGRAMDATA__ token rather than passing it through as a path; does not rewrite a path that merely BEGINS with the token characters; keeps a drive-letter path with mixed separators intact; splits a spaced Windows home into the fragments the rejoin has to put back. src/main/ssh/config/ssh-known-hosts.test.ts: reads the algorithm from the blob rather than trusting the line; rejects %s; refuses a malformed blob: %s; uses the bare host on the default port; tries the bracketed form first and falls back to bare off-port; matches an exact line; matches case-insensitively; reports a changed key of the same type; reports unknown for %s; matches any host in a comma list; matches the bracketed form on its port; does not apply a bracketed entry to the default port; falls back to a bare line when off-port; never reports a change from the fallback pass; matches a bare literal on the default port; matches a bracketed literal on its port; reports a change for a literal; handles %s; still reports a change for a different key on a revoked host; skips a line carrying an unrecognised marker; does not report a change when only another key type is on file; matches within the same type; accepts CRLF terminators; skips blanks, comments and surrounding whitespace; accepts a hit regardless of which file holds it (%s); never brackets the alias, whatever the port; still brackets an ordinary host on a non-default port; matches a bare alias entry on a non-default port; still accepts the unmodified key field; accepts a hashed entry whose salt is a full SHA1 digest; still accepts the unmutated ssh-keygen -H vector; falls back to the bare host line on a non-default port, as ssh did; refuses a key type it has not seen for a host it knows, as ssh did. src/main/ssh/connection/ssh-connect-config.test.ts: returns undefined when no default keys exist; returns the first existing key file; probes regular and FIDO2 keys in stable default order; keeps a regular default ahead of a malformed FIDO2 default; uses target host/port/username; falls back to resolved config when target fields are empty; keeps imported endpoint fields as the fallback when ssh -G is unavailable; sets readyTimeout to CONNECT_TIMEOUT_MS; sets keepaliveInterval to 15s; enables keyboard-interactive auth so MFA challenges can be answered; uses agent auth when no explicit key and SSH_AUTH_SOCK is set; enables agent forwarding when OpenSSH config requests it and an agent is available; does not enable agent forwarding without a usable agent; resolves IdentityAgent SSH_AUTH_SOCK from the environment; uses the Windows OpenSSH agent pipe when no environment socket is available on Windows; wraps agent auth with IdentityFile filtering when IdentitiesOnly is enabled; applies a manual target IdentitiesOnly setting when ssh -G reports it off; includes unencrypted target.identityFile auth when an agent is available; defers encrypted target.identityFile auth when an agent is available; uses keyFile auth when target.identityFile is set and no agent is available; includes unencrypted resolved identityFile auth when an agent is available; defers a default-path resolved identityFile to the no-agent retry; offers the keyboard-interactive challenge when the agent defers no key; provides fallback key when no agent is available; can force private key inclusion for the post-agent fallback path; falls back to resolved proxyCommand; returns structured jump-host config for target.jumpHost; returns structured jump-host config for resolved proxyJump; returns undefined when no proxy is configured. src/main/ssh/connection/ssh-connection-auth-fallback.test.ts: resolves OpenSSH config using configHost when present; tries ssh-agent before reading an explicit private key; falls back to direct private key auth when agent auth fails; falls back to direct private key auth after too many agent authentication failures; answers bounded keyboard-interactive challenges such as Duo 2FA. src/main/ssh/connection/ssh-connection-store.test.ts: lists picker suppression aliases without consulting re-adoption tombstones; getTarget delegates to store; addTarget generates an id and persists; saves the CLI control switch as given, with no consent stamp; addTarget stamps source as manual by default; addTarget preserves an explicitly provided source; inserts a new config host stamped as ssh-config; asks the parser for all hosts — reconciliation happens in the store; updates an existing config-sourced target when the port changed; refreshes gssapiAuthentication on sync; never overwrites a manual target that owns the alias; does not rewrite an unchanged config-sourced target; returns empty array when nothing changed; tombstones a deleted config-sourced host so re-import skips it; suppresses a deleted manual target from config discovery; re-adding a deleted host reclaims its alias so sync stops suppressing it; editing a target reclaims its alias from the deleted set; records a tombstone when removing any user-facing target; re-adopts orphaned repos when the same host is re-added. src/main/ssh/connection/ssh-connection.test.ts: transitions to connected on successful connect; captures the negotiated SSH server key fingerprint; allows concurrent exec commands for ssh2 transport; removes startup listeners after ssh2 connect succeeds; scopes lifecycle events and pending handshake timers to one mock client; enables TCP_NODELAY on the new ssh2 client after a reconnect cycle; transitions through connecting → connected states; reports error state on connection failure; disconnect cleans up and sets state to disconnected; getTarget returns a copy of the target; getState returns a copy of the state; throws when connecting a disposed connection. src/main/ssh/orcad-migration-stuck-host-profiles.test.ts: never leaves a running terminal behind; is offered only when leaving saved state behind would clear the refusal. src/main/ssh/orcad-runtime-maintenance.test.ts: keeps a connect from retrying a build an explicit Update also failed; offers Force when Update was refused by policy; forwards anew after an activation, since the new slot may bind another port; passes a refusal through and leaves the server linked; forwards anew once a serving slot is restored, which may have bound another port. src/main/ssh/port-forwarding/ssh-port-forward.test.ts: reports the port the OS bound when an ssh2 forward asks for port 0; adds an ssh2 port forward and returns entry; adds a system SSH port forward when no ssh2 client is available; reports the port a system SSH forward resolved when asked for port 0; passes resolved OpenSSH config to system SSH port forwards; disposes a system SSH tunnel when removing the forward; lists forwards filtered by connectionId; removes a forward by id; awaits forward close when removing a forward for user actions; returns null when removing nonexistent forward; removes all forwards for a connection; dispose removes all forwards; stores label in the entry; preserves the existing id when updating a forward succeeds. src/main/ssh/ssh-channel-multiplexer.test.ts: sends a JSON-RPC request and resolves on response; assigns unique request IDs; sends notifications without expecting a response; dispatches incoming notifications to handler; sends one keepalive frame per cadence tick; drives keepalive sends AND dead-link detection from a single interval; resolves false immediately on a disposed mux; throws on request after dispose; reports isDisposed correctly; clears registered handlers on dispose; does not retain handlers registered after dispose. src/main/ssh/system-transport/system-ssh-forward-process.test.ts: spawns exactly the argv the orphan matcher is given, LogLevel=INFO included; runs port forwards unmultiplexed even when ssh_config disables muxing; preserves manual target port and identity options in the forwarded ssh command; does not spawn ssh when the requested local forward port is already in use; spawns ssh after the requested local forward port preflight succeeds; resolves startup after the grace period when ssh keeps running; sends SIGTERM then SIGKILL when the process does not exit; does not resolve stop until the process exits. src/main/ssh/system-transport/system-ssh-loopback-route.test.ts: dials the held forward ahead of the alias so OpenSSH keeps these over ssh_config; drops a manual target's own port and proxies, which would fight the route; never routes a forward, whose argv must stay stable for orphan recovery; %s → %s; opens the forward over the real proxy, then proves a login over the route; lands the forward on the sshd and known_hosts name the direct route resolved; holds the forward with server-alive probes; never lets the background forward or probe ask for credentials; starts no forward when admission refuses the route; stops the forward when sshd refuses logins over it; stops the whole forward process tree on Windows, once; reports a forward that already exited before anyone listened for it. src/main/startup/browser-process-user-agent-ordering.test.ts: explains admission refusal before a desktop launch exits; explains an orcad holding the profile instead of exiting silently; does not acquire profile admission for a duplicate launch; executes after the dev app name and before later preflight work; exits and releases admission after pending profile move recovery fails; keeps Linux background startup failures console-only and immediate; keeps Linux serve startup failures console-only and immediate. src/main/startup/quit/quit-path-durable-write-blocking.test.ts: store.flushAsync() issues no synchronous fs syscalls; store.flushAsync() also moves the active-view and github-cache sidecars off the thread; stats.flushAsync() issues no synchronous fs syscalls; Grok session cleanup issues no synchronous fs syscalls; stats.flushAsync() closes out live agents before it returns, not when its write lands; a stalled mount leaves the event loop live instead of parking it; store.flushAsync() is one idempotent final barrier; store.flushAsync() resolves instead of throwing when the profile mount rejects writes. src/main/stats/agent-session-transition-recorder.test.ts: counts a hook-only agent that never writes an agent-shaped terminal title; never opens a session from a replayed or disk-restored working status; still closes a live session when the terminating status arrives as a replay; counts one session per turn across repeated working/done cycles; closes an open session when its pane is torn down; bounds the mirror and closes what it evicts; stops the session when the main agent settles and only a watch loop holds the row working; keeps the session open while a subagent outlives the main agent, and closes it when the child settles; dates the stop by the evidence when a shell outlives the last subagent; opens a new session dated by the observation when the main agent resumes after monitoring; never dates a reopen before the close a fact-less OSC repaint caused; dates the first live row after a restored one by the evidence, not the restored clock; treats an unchanged answer as a snapshot, never a transition; opens only on a live working edge; closes only a session it opened. src/main/text-generation/commit-message-text-generation-model-discovery.test.ts: returns static catalog models without spawning for static agents; discovers dynamic models through the agent CLI; discovers dynamic models through the configured agent command override; falls back to static models when dynamic discovery returns no parseable models; falls back to the first discovered non-Pi model when its static default is unavailable. src/main/text-generation/pull-request-context.test.ts: does not fetch unrelated fork remotes before generating PR context; bounds exact remote-ref probe concurrency for a large remote list; reports no branch change because PR context preparation is read-only; keeps a remote-qualified base when the selected base includes the remote. src/main/text-generation/source-control-local-process.test.ts: asks the supervisor to stop and leaves its group to it; signals nothing once the supervisor has exited; stops an agent that ignores its stdin end through its supervisor. src/main/updater/linux-package/linux-package-update-recovery.test.ts: retains the downloaded package with the digest from the event metadata; requires a string downloaded path; accepts an uppercase extension; requires a non-empty string version; matches an absolute file URL by basename; accepts duplicate entries that agree on the digest; refuses an entry with a missing or non-string digest; refuses a digest that is not base64 at all; refuses a malformed percent-encoded URL; refuses a missing or non-array file list; tolerates a non-object event; replaces the retained artifact with a newer download; keeps the retained artifact when a new download has no usable digest; keeps the retained artifact when an unrelated download event arrives; clears the retained artifact; preserves the artifact across a recheck of the same version; clears the artifact when another version takes over; preserves the artifact for an unknown or empty version; is a no-op without a retained artifact; returns the built command and package file name for a verified package; reports missing without a retained artifact; propagates a package-manager discovery failure; rejects a well-formed digest that belongs to another file; never hashes a package that a malformed digest failed to arm; rejects a path outside the cache root; rejects the cache root itself; rejects a package in the updater directory itself; rejects a pending directory that is a symlink out of the cache; performs one hash pass for concurrent requests; revalidates once the in-flight pass settles; does not reuse an in-flight pass for a different artifact; starts a fresh proof when the same package is captured again; returns the verified package path; returns missing without a retained artifact. src/main/updater/releases/updater-prerelease-feed-readiness.test.ts: accepts a GitHub %s asset redirect as ready; reports a GitHub asset request error as unavailable; reports not-ready with a verified last-good tag when the newest assets are unavailable; does not classify a non-positive tag limit as feed unavailability; reproduces the v1.4.142 publishing incident as not-ready; reports transport failures as unavailable instead of not-ready; treats an explicit asset 404 as not-ready when another asset is unavailable; accepts absolute manifest asset URLs without rewriting them to release asset paths; returns not-ready with an older ready update as last-good while newest is publishing. src/main/updater/releases/updater-release-builds.test.ts: lists hourly builds from the dedicated repo, newest first; lists daily builds from the dedicated repo, newest first; separates stable from rc in the shared main repo; skips drafts and unparseable tags; keeps a composed release title and drops one that repeats the tag; hides builds that published no artifact for this platform; returns an empty list when no build has this platform artifact; keeps mac builds visible on macOS regardless of the Windows leg; resolves the platform installer download url; leaves the installer url null when the release published no installer; tolerates a release whose assets are missing or malformed; sends the local gh token as a bearer header when one is available; sends no authorization header when gh has no token; retries unauthenticated once when GitHub rejects the token; does not retry a 401 that was already unauthenticated; falls back to the per-IP bucket when the token is rate limited and tells the gh breaker; reports a secondary limit carrying retry-after without retrying or tripping the breaker; records a primary limit in the token scope %s; keeps %s authenticated when only %s is blocked; skips the token while its scope %s is blocked; surfaces a rate limit with its reset time and a sign-in hint when unauthenticated; omits the sign-in hint when the rate-limited request was authenticated; treats 429 as a rate limit; reports a 403 without rate-limit headers as a plain HTTP error; reports a missing hourly repo distinctly; is null when GitHub sent no reset; prefers retry-after over the primary reset epoch; falls back to the primary reset epoch when there is no retry-after; reads retry-after as seconds; reads retry-after as an HTTP date; pins an hourly tag at the hourly repo download path; pins a daily tag at the daily repo download path; pins a stable tag at the main repo download path; rejects a tag that is not a version. src/main/updater/updater.build-channel-selection.test.ts: uses the display label in the unsupported-platform %s pinned-build error; still pins %s from an unsigned Windows dev build; restores ordinary release checks after local build selection fails; opts into the RC channel when checkForUpdatesFromMenu is called with includePrerelease; pins the generic feed to a perf-tagged prerelease when requested; surfaces no-update feedback when no newer perf-tagged prerelease exists; keeps prerelease publishing-window misses on the generic retry path; leaves the feed URL alone for a normal user-initiated check. src/main/updater/updater.check-preflight.test.ts: ignores a stale update-not-available event after a new check starts preflight; deduplicates repeated manual checks while the immediate checking status is active. src/main/updater/updater.prerelease-fallback.test.ts: retries a prerelease check once against the previous feed tag when the manifest is missing; surfaces a promise-only prerelease fallback failure after the primary error event. src/main/updater/updater.publishing-window-feed.test.ts: repins the generic feed to the newest RC tag for a prerelease user; repins the generic feed to a newer stable tag for a prerelease user; pins a stable fallback when Atom has no newer prerelease; uses last-good concrete feed when a user-initiated check lands during publishing; can offer an older fully published update while the newest release is publishing; keeps background publishing-window fallback on the short retry cadence. src/main/updater/updater.quit-and-install.test.ts: surfaces an accepted retry before electron-updater emits download progress; defers quitAndInstall and runs its launcher within the launch PATH scope; runs pre-quit cleanup before local PTY cleanup during update install; keeps optional pre-quit cleanup fail-and-continue behavior by default; ignores duplicate quitAndInstall requests while the shared delay is pending; arms the forced-exit watchdog once the install commits; disarms the forced-exit watchdog when sync install error recovery keeps the app open. src/main/window/createMainWindow-markdown-editor-focus.test.ts: ignores traffic light sync IPC on non-macOS; still intercepts Cmd+Shift+B and Cmd+Alt+B when the markdown editor is focused; coerces non-boolean setMarkdownEditorFocused payloads to false; opens a table-aware context menu synchronously without a renderer query; builds the plain edit menu for the one right-click the renderer marks as plain text. src/main/window/createMainWindow-renderer-crash-recovery.test.ts: notifies the caller when the renderer process is gone; passes the renderer webContents id through crash recording and recovery callbacks; forwards expected renderer teardowns so the recorder can diagnose suppression; reloads the app shell after an unexpected renderer process loss; does not reload after renderer loss when recovery is disabled; stops auto-reloading after a rapid renderer crash loop trips the breaker. src/main/window/dashboard-popout-window.test.ts: updates the title after language initialization and unsubscribes when closed; lets its preload expose saved WSL hosts in serve-only, and passes nothing otherwise; creates a native-frame window with the shared preload and no webview surface; shows the window on ready-to-show; loads the prod file entry; loads the dev server URL when in dev; focuses the existing window instead of creating a second one; trusts only the live popout webContents; restores a minimized window when re-requested; restores valid persisted bounds; discards off-screen persisted bounds and falls back to defaults; persists bounds on resize after the debounce, guarding near-minimum sizes; keeps saving bounds after a vetoed quit and freezes them only on an allowed quit; closeDashboardPopout closes an open window; applies the persisted app zoom level on dom-ready; follows app zoom changes while open and unsubscribes on close; zoomDashboardPopoutIfFocused steps the popout zoom only while focused; handles the zoom-in chord via before-input-event and ignores other keys; handles mouse-wheel zoom requests outside before-input-event; respects zoom keybinding overrides for keyboard and mouse-wheel paths. src/main/window/dropped-path-preparation.test.ts: opens and stores each unique source once as drop size grows tenfold; passes ordinary paths without copying for %s; preserves ordinary successes and copied successes when another file fails; serializes copy requests from different owners; reports all lost paths without a shared reason when their failures differ. src/main/window/main-window-updater-deferred-setup.test.ts: releases all 64 completed fallback handles without repeating initialization; keeps setup after ready-to-show and releases its fallback afterward; preserves the 15-second fallback when first paint never arrives; preserves destroyed-window guard reads before and at the fallback deadline; keeps the exact %s error and releases its completed fallback; keeps the exact fallback %s error without retrying initialization; preserves pending manual setup after failed ready registration; keeps setup options, live store reads, nudge writes and required quit flush. src/main/worker-threads/worker-thread-request-queue.test.ts: posts one request at a time and in the order it was dispatched; fires a posted call at its own deadline; stops respawning and fails the rest of the queue once deaths hit the cap; clears the death count when a fresh burst starts from full idle. src/main/workspace-hooks/hooks-setup-runner-script.test.ts: builds Windows runners for newline-heavy scripts without line-array splitting; builds POSIX runners without regex-wide CRLF normalization; writes POSIX setup runners for shebang-declared scripts on native Windows paths; keeps batch setup scripts on cmd.exe when the terminal is Git Bash; hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner; replays interpreter flags declared on the shebang line; preserves cmd.exe setup runner semantics for configured cmd users; keeps POSIX runner behavior on POSIX platforms; waits when either local or project policy requires completed setup; marks setup-runner terminals for the always-on credential guard; maps git-bash to POSIX setup launch metadata on Windows; falls back to the cmd runner when the git-bash setting has no installed Git Bash; keeps the cmd runner for a non-Git bash such as Cygwin; keeps the cmd runner for a bare bash whose flavor cannot be resolved; uses the POSIX runner for a bare bash that resolves to Git Bash; uses the POSIX runner for an extension-less Git Bash path; preserves the existing cmd runner for PowerShell terminals; preserves cmd setup compatibility when a Windows-host project has a WSL shell setting; classifies an installed explicit Git Bash executable as a POSIX runner; falls back to the cmd runner when the explicit Git Bash path no longer exists. src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts: schedules remote identity enrichment without blocking the caller; probes a drive project whose runtime is WSL %s; sweeps a local repo: %s; probes an SSH row that carries only executionHostId on its own host; keeps same-path rows on two different SSH hosts from sharing one backoff; coalesces concurrent probes for the same repo location; caches no-identity probes briefly so list calls do not retry every time; does not rewrite the no-remote marker on a later retry; resolves a settled no-remote repo once it gains a remote; does not re-probe a resolved identity before the refresh window elapses; re-probes a resolved identity after the refresh window elapses; bounds re-probes per sweep so a large repo list drains gradually; forgets a removed repo location so its deadline cannot outlive the repo; keeps a surviving repo backoff when a sibling repo is removed; probes again when the same location is re-added after its probe was retired; coalesces concurrent sweeps instead of running one pass per list call. src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts: preserves create priority through claim probes on %s; starts the checkout only once the async workspace root resolves; still deduplicates when both callers await the same pending root lookup; namespaces native Windows preparation directories for long paths; deduplicates preparation for the same repo, base, runtime, and workspace root; does not spend a divergence walk when the base matches exactly; claims when the two sides spell the same ref differently; evicts a repo's own stale preparation before another repo's; still discards armed checkouts when the project runtime needs repair; routes preparation and finalization through the selected WSL runtime; retries stale cleanup after a transient listing failure; does not discard a detached worktree with caller-controlled preparation metadata; does not re-arm after an isolated create; re-arms a preparation once creates arrive in a burst; holds the re-arm checkout until the create runs the deferred thunk; starts one explicit prefetch after the create completes; does not re-arm when finalization failed; reports a pending create while a stale-cleanup scan is running. src/main/workspaces/removal/local-worktree-removal-recovery.test.ts: recovers Git for Windows partial filesystem deletion failures; finishes a clean non-force deletion after Git leaves a Windows directory behind; recovers localized Windows failures after Git already removed the registration; does not recover unrelated localized failures while Git still owns the row; finishes a macOS deletion Git deregistered before failing with Directory not empty; leaves an orphaned checkout to the orphan cleanup instead of deleting it; prunes and strictly verifies on the selected WSL host without deleting files or branches. src/main/workspaces/removal/worktree-removal-safety.test.ts: rejects deleting a worktree that contains another registered worktree; rejects POSIX home directories even when host homedir has a different path shape; refuses a home the host reported even when no path rule recognises it; refuses the Windows host's home directory from a POSIX client; refuses the Windows host's home directory even when the host reported nothing. src/main/wsl/discovery/distro-catalog.test.ts: retries asynchronous discovery after a transient wsl.exe failure; retries synchronous discovery after a transient wsl.exe failure; retries asynchronous discovery after wsl.exe reports no distros yet; retries synchronous discovery after wsl.exe reports no distros yet; bounds the wsl.exe spawn rate while no distros are installed; bounds the asynchronous spawn rate while no distros are installed; still caches a non-empty distro list for the process lifetime; re-probes a docker-desktop-only machine once a user distro can appear; backs off while the list keeps coming back empty; backs off after repeated distro-list failures; caps the empty-list backoff at five minutes; keeps reporting an empty result after it goes stale; keeps reporting a known distro list indefinitely; bounds cached homes while retaining the most recently used distros; still lists distros, and an excluded distro home probe fails like any other probe; gives the async home probe time for a cold boot instead of killing it at 5 s; retries availability after a probe timeout instead of latching false; bounds the probe rate while the failure window is open; caches a successful probe for the process lifetime; names an explicit spawn directory, so no deleted cwd can read as ENOENT; shares one wsl.exe spawn between concurrent probes; keeps reporting the last observed answer after it goes stale; holds a definitive failure far longer than a timeout when %s; backs off after repeated probe failures; re-probes a seeded retryable failure once its window lapses; re-probes availability once a distro list succeeds after %s; does not drop an availability failure for an empty distro list; keeps reporting unavailable off Windows without probing. src/main/wsl/discovery/wsl-distro-holder.test.ts: runs a busybox-safe loop through --exec and names the distro; spawns a detached-style holder, records it, and waits for the distro to run; a holder exiting with code 1 notes its distro may have stopped (E9); rejects a pid whose command line is not our holder for that distro; cleans up stale and corrupt records; keeps a holder and its record when release cannot verify it; reports unverifiable when the command line is unreadable even with a matching pid; release kills a verified holder and removes its record; release never kills a pid that is no longer our holder; reports a spawned holder exit so liveness can re-check. src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts: skips 9p shares that are not drvfs, and malformed lines. src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts: plans the update on the census the running orcad reports, not an unknown one; forwards force to the update planner; does not serve the incumbent past a refusal that is not a wait; does not re-activate the build this host rolled back from; labels the launch with the build the adoption found serving, not the stale record; defers while another run holds the host fence; lets an explicit force deploy past both skips; names a newer host refusal apart from a rolled-back one, so only Force is offered; updates an older host as before, without asking to adopt it; never asks the incumbent when it already runs this build. src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts: keeps a completed listing usable when the host rejects the wait parameter. src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts: delivers to chat-default users in all targeting while holding out not-switched users. src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts: completes the row on a pick, even when the command is already typed; ignores a pick of the row while side chats are unavailable. src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts: explains a too-large refusal that arrives through the IPC error prefix. src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts: keeps the question with the caller and says once that it never went; tells the user to check the side chat when delivery is unconfirmed; reports a delivered question as sent, silently. src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts: decides each of %i tool-only turns once per layout, and nothing without a listener. src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx: places a side chat whose question was %s: %o. src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts: calls back once for %s; stops watching once unsubscribed. src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts: records a mode 2031 subscribe from the raw chunk boundary without answering. src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts: routes terminal input through deferPtyInput so the host can withhold it; forwards terminal input directly when the host supplies no deferPtyInput. src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts: forwards onBell to pane attention and notification policy; hands the bell to the attention module with its pane even when pane attention is off. src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts: repaints from the main-owned snapshot when main drops pending output at the cap. src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts: retries a fresh-spawn native follow reset when renderer dimensions return. src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts: requests a tab remount for an unbound spawn; leaves recovery to a remote transport that armed its own retry; requests a remount when the transport reports no recovery of its own; settles the spawn as failed before requesting a remount; prefers the restored leaf id when reporting the anomaly; falls back to the pane leaf id when no restored leaf exists. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionDeferredInputForwardingTests } from '../input/pty-connection-deferred-input-forwarding.spec', registerPtyConnectionDeferredInputForwardingTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts: structural support changed only; no new authored removal credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionFreshNativeFollowResetTests } from '../output/pty-connection-fresh-native-follow-reset.spec', registerPtyConnectionFreshNativeFollowResetTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts: remove only literal registration import/call pairs import { registerPtyConnectionTerminalBellAttentionTests } from '../notifications/pty-connection-terminal-bell-attention.spec', registerPtyConnectionTerminalBellAttentionTests(); no additional authored credit. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts: registers interest on the first sidecar and releases on the last unsubscribe; releases sidecar interest only once for repeated unsubscribes; does not let an eager pre-mount buffer defeat hidden delivery gating; keeps eager buffers outside delivery interest when the PTY exits before mount; lets a sidecar exclusively own interest while an eager buffer overlaps. src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts: blackholed delivery reproduces the wedge: no handler dispatch, no ACK ever. src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts: sends preferences to the execution host and attaches only to its returned PTY; preserves one operation ID across a lost reply and reconnect; preserves ordinary raw startup and captured-session attachment. src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts: says nothing once the pane is closed. src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts: refreshes after each scheduled atlas reset; falls back to a timeout when animation frames are unavailable; continues recovery when a manager throws after scheduling. src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts: tracks a remounted quiet title source even when the stale owner unregisters later; preserves the renderer-parsed output sequence in the response; preserves a pending escape tail for snapshot replay; routes a host's Reset Terminal request to the pane that owns the PTY. src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts: marks panes with restored scrollback for fresh-shell viewport blanking. src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts: recovers a 0x0 spawn whose container is briefly unmeasurable then settles. src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts: removes global listeners when the last pane unregisters. src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx: keeps trust text readable on a host-owned dialog surface; applies the hostile surface to ordinary dialogs, so the case above is exercised. src/renderer/src/components/use-terminal-parking-pass.test.tsx: does not queue a render when a pass produces the same parking sets; keeps parking transitions working under StrictMode. src/renderer/src/hooks/client-workspace-view-report.test.ts: reports an away user’s screen with no presence, and renews as soon as input returns; retries a failed send, empty or not, no sooner than a refresh. src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts: is new work in a workspace with no live terminal: its first bind moves it up in Recent. src/renderer/src/hooks/use-bundled-skill-install.test.tsx: ignores a repeated click while the install runs; retries the last requested skills on this host. src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx: adds seeds to a successful empty list but not to loading or failed results; retains seed projection after expiry and fetches fresh metadata for a new reader. src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx: retranslates the settings nav labels when the UI language changes live. src/renderer/src/lib/codex-stale-pane-account-identity.test.ts: keeps the prompt when the roster read fails and every label collapses. src/renderer/src/lib/image-blob-png.test.ts: downscales a pasted image above the pixel cap; releases its temporary URL on a decode error; releases its temporary URL when PNG encoding fails or exceeds the byte cap. src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts: names callers above the frame the write came from; restores Error.stackTraceLimit when the capture throws; stops collecting after the sample cap when captureStackTrace is unavailable; caps reported changed keys from a single wide write. src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts: applies the rendered text hard cap last and reserves the final overflow marker. src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts: keeps the runtime target identity stable across unrelated store writes. src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts: keeps creation available on old hosts and explains the missing operation; preserves landed warnings and direct collision recovery data; propagates remote discovery failure instead of a false empty page. src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts: reuses unchanged worktree tab projections when one worktree title changes; bumps only the changed worktree version when a sibling stays byte-identical. src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts: shares safe-auto fork sync cooldown attempts across store instances. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts: collapses a 193-workspace hydration to one store write; leaves the store byte-identical to the per-workspace path; re-reconciling the batched result is a no-op, as it is for the per-workspace path. src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts: dedicated zero-case helper retirement; no authored test credit. src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts: persists each batch metadata update to its workspace owner. src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts: dismisses a rename error on its capable remote owner; clears pending first-agent rename when the title is updated. src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts: orders capture, guards, handlers, main's stop, commit, cleanup, and exit settlement. src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts: publishes the first terminal and root tab group atomically; publishes the first terminal and root tab group atomically, then marks it starting in main. src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts: restores daemon terminal wake hints before declaring the session ready. src/renderer/src/web/web-runtime-connection-auth-framing.test.ts: keeps legacy framing for sockets that cannot absorb a refused attempt. src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts: moves the old Windows default to Regular once and queues the notice; keeps custom weights and fresh profiles without a notice; leaves macOS and Linux profiles untouched. tests/e2e/claude-agent-row-view.unit.test.ts: updates a mounted compact workflow description through the subscribed production parent; bounds upstream active-SSH visits for $population records, fallback=$fallback; derives %s destinations without requiring type or a workflow child ID; terminates a $path parent $status with no third request or intermediate toast; does not recover a first child %s. tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts: keeps exact legacy ordering when structured creation cannot express afterTabId; can create a terminal without selecting the target worktree; preserves the legacy fresh-agent path when host authority is unavailable. tests/e2e/paired-instant-browser-tab.spec.ts: shows a paired browser tab before its create RPC resolves, then keeps it as one tab; adopts a paired browser tab without rebuilding its chrome. tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts: bounds host publication and renderer application across remote worktrees; globally caps decorative freshness while every working status stays fresh. tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts: bounds saved-order publication selection at N and 10N without rematerializing navigation; bounds admitted placement reconciliation during supported reads at N and 10N; bounds selection input visits at 50 and 500 rows, including unavailable-target projection; keeps publication scoped to a changed worktree and shared by listeners at N and 10N; bounds preserved-chat merge and runtime-owned hydration at N and 10N (legacy=%s); bounds actual native retirement and shared delivery work at N and 10N. tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts: does not substitute a preserved row for an unavailable explicit legacy selection; resolves main-layout group selection %s (omitted group=%s). tests/e2e/structured-agent-session-launch-admission.unit.test.ts: opens a direct caller's terminal with the caller's own CLI arguments on a decline; opens the chat on the server that admitted it; opens only the terminal when this machine declines, without a notice; opens a new agent tab's terminal with the typed prompt when the caller names none; opens the chat, not a terminal, when this machine cannot resolve a new workspace yet; keeps its terminal fallback, as before. tests/e2e/structured-attention-prompt-relay.unit.test.ts: settles once per relayed prompt, not on every later status update. tests/e2e/structured-attention-read-retirement.unit.test.ts: Mark read on a chat never opened withdraws the prompt alert it surfaced; Mark read on a chat hidden since an earlier view covers the newer prompt it surfaced; reads a newly accepted visible prompt without sending an RPC for text-only updates. tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts: counts real raw stores, unrelated window publications and captured cleanup at %i chats; counts complete supplied-member sweep and separate final retirement at S=%i N=%i. tests/e2e/structured-session-workspace-authority.unit.test.ts: bounds actual target reveal across %i repo roots and metadata aliases. tests/e2e/terminal-agent-pane-launch.unit.test.ts: starts the host's planned command once, at the pane's size, and says it started; plans a pane whose prompt the window submits without the startup update prompt; preserves caller shell-ready delivery only for a connection-scoped adapter ($connectionId); starts no shell on plan failure (original failure: $returnLaunchFailure); cannot confirm a start whose provider answer was lost. tests/e2e/terminal-parked-memory.spec.ts: releases renderer terminal memory when hidden tabs park. tests/e2e/terminal-shortcuts.spec.ts: @headful Codex-like background output stays visible without disabling WebGL in auto mode; Shift with Russian layout text reaches the PTY as Cyrillic under kitty keyboard reporting. tests/e2e/terminal-split-activation-latency.spec.ts: records attributed CWD, spawn, bind, fixture-ready, input, and echo phases. tests/e2e/terminal-split-activation-latency-phases.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-main-probe.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-artifact.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-split-activation-latency-report.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-tab-switch-visual-restore.spec.ts: restores skipped hidden Grok output on light tab resume. tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts: delivers independent %s effort through the real prepared web callback; keeps same-ID local and runtime worktrees on the selected runtime owner; creates paired web agents through host authority so activation is mirrored; delivers generated continuation context after host-authoritative creation; seeds the chat composer for a draft that rode in on the launch command. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/persistence/worktree-sort-order-write.test.ts, src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/integrations/skill/orca-runtime-skill-recovery.test.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts, src/main/runtime/rpc/methods/terminal/terminal-multiplex-link-estimate.test.ts, src/main/runtime/rpc/methods/terminal/terminal-snapshot-scrollback-rows.test.ts, src/main/runtime/rpc/server/pairing/network/windows-default-route-interfaces.test.ts, src/main/runtime/rpc/server/pairing/pairing-offer-owner-cli.test.ts, src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts, src/main/runtime/session-graph/headless-runtime-graph.spec.ts, src/main/runtime/session-graph/runtime-graph-standing-contracts.test.ts, src/main/runtime/session-tabs/structured-conversation-tab-title.test.ts, src/main/runtime/session-tabs/terminal-close-observed-exit.test.ts, src/main/runtime/terminal/identity/terminal-identity-probe.test.ts, src/main/runtime/terminal/layout/paired-desktop-server-writes-layout-owner.test.ts, src/main/runtime/terminal/lifecycle/pty-lifecycle-generation-retention.test.ts, src/main/runtime/terminal/lifecycle/run-terminal-user-open.test.ts, src/main/runtime/terminal/surface/terminal-surface-replies-window.test.ts, src/main/runtime/terminal/surface/workspace-layout-projection.test.ts, src/main/runtime/terminal/view/terminal-subscribe-exit-waiter-leak.test.ts, src/main/runtime/terminal/wait/orca-runtime-exact-worker-provider-session.test.ts, src/main/runtime/terminal/wait/prime-agent-screen-readiness-transcripts.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-agent-startup.test.ts, src/main/runtime/workspaces/startup/runtime-worktree-startup-readiness.test.ts, src/main/skills/skill-install-transaction.test.ts, src/main/speech/model-manager-download-resume.test.ts, src/main/ssh/config/ssh-config-parser.test.ts, src/main/ssh/config/ssh-known-hosts-source.test.ts, src/main/ssh/config/ssh-known-hosts.test.ts, src/main/ssh/connection/ssh-connect-config.test.ts, src/main/ssh/connection/ssh-connection-auth-fallback.test.ts, src/main/ssh/connection/ssh-connection-store.test.ts, src/main/ssh/connection/ssh-connection.test.ts, src/main/ssh/orcad-migration-stuck-host-profiles.test.ts, src/main/ssh/orcad-runtime-maintenance.test.ts, src/main/ssh/port-forwarding/ssh-port-forward.test.ts, src/main/ssh/ssh-channel-multiplexer.test.ts, src/main/ssh/system-transport/system-ssh-forward-process.test.ts, src/main/ssh/system-transport/system-ssh-loopback-route.test.ts, src/main/startup/browser-process-user-agent-ordering.test.ts, src/main/startup/quit/quit-path-durable-write-blocking.test.ts, src/main/stats/agent-session-transition-recorder.test.ts, src/main/text-generation/commit-message-text-generation-model-discovery.test.ts, src/main/text-generation/pull-request-context.test.ts, src/main/text-generation/source-control-local-process.test.ts, src/main/updater/linux-package/linux-package-update-recovery.test.ts, src/main/updater/releases/updater-prerelease-feed-readiness.test.ts, src/main/updater/releases/updater-release-builds.test.ts, src/main/updater/updater.build-channel-selection.test.ts, src/main/updater/updater.check-preflight.test.ts, src/main/updater/updater.prerelease-fallback.test.ts, src/main/updater/updater.publishing-window-feed.test.ts, src/main/updater/updater.quit-and-install.test.ts, src/main/window/createMainWindow-markdown-editor-focus.test.ts, src/main/window/createMainWindow-renderer-crash-recovery.test.ts, src/main/window/dashboard-popout-window.test.ts, src/main/window/dropped-path-preparation.test.ts, src/main/window/main-window-updater-deferred-setup.test.ts, src/main/worker-threads/worker-thread-request-queue.test.ts, src/main/workspace-hooks/hooks-setup-runner-script.test.ts, src/main/workspaces/catalog/repo-git-remote-identity-enrichment.test.ts, src/main/workspaces/creation/preparation/worktree-create-preparation.test.ts, src/main/workspaces/removal/local-worktree-removal-recovery.test.ts, src/main/workspaces/removal/worktree-removal-safety.test.ts, src/main/wsl/discovery/distro-catalog.test.ts, src/main/wsl/discovery/wsl-distro-holder.test.ts, src/main/wsl/filesystem/wsl-guest-drive-mountinfo.test.ts, src/main/wsl/orcad/wsl-orcad-deploy-app-update.test.ts, src/renderer/src/components/agent/agent-launch-picker-acquisition.test.ts, src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts, src/renderer/src/components/native-chat/composer/pickers/use-native-chat-side-chat-command.test.ts, src/renderer/src/components/native-chat/media/images/native-chat-image-copy.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-fork-launch.test.ts, src/renderer/src/components/native-chat/messages/actions/native-chat-side-chat-fork-point.test.ts, src/renderer/src/components/native-chat/messages/actions/use-native-chat-fork.test.tsx, src/renderer/src/components/terminal-pane/provider-notices/agent-presence/agent-terminal-presence.test.ts, src/renderer/src/components/terminal-pane/pty-connection/emulation/pty-connection-mode2031-raw-subscription.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/input/pty-connection-deferred-input-forwarding.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/notifications/pty-connection-terminal-bell-attention.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output-restore/pty-connection-dropped-output-snapshot-healing.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/output/pty-connection-fresh-native-follow-reset.spec.ts, src/renderer/src/components/terminal-pane/pty-connection/spawn/unbound-pane-spawn-recovery.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-foreground-agent.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-hidden-replay.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-input-and-repaint.test.ts, src/renderer/src/components/terminal-pane/pty-connection/tests/pty-connection-spawn-and-startup.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-delivery-interest.test.ts, src/renderer/src/components/terminal-pane/pty-transport/delivery/pty-dispatcher-push-reattach.test.ts, src/renderer/src/components/terminal-pane/pty-transport/ipc/ipc-pty-opencode-model.test.ts, src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts, src/renderer/src/components/terminal-pane/pty-transport/remote-runtime/remote-runtime-pty-transport-prebind-discard-notice.test.ts, src/renderer/src/components/terminal-pane/render-health/terminal-webgl-atlas-recovery.test.ts, src/renderer/src/components/terminal-pane/snapshots/pty-buffer-serializer.test.ts, src/renderer/src/components/terminal-pane/snapshots/saved-terminal-output-replay.test.ts, src/renderer/src/components/terminal-pane/viewport/split-right-white-screen.test.ts, src/renderer/src/components/terminal-pane/viewport/visibility/stale-document-visibility.test.ts, src/renderer/src/components/ui/security-surface-theme-contrast.test.tsx, src/renderer/src/components/use-terminal-parking-pass.test.tsx, src/renderer/src/hooks/client-workspace-view-report.test.ts, src/renderer/src/hooks/ipc-events/terminal-request-ipc-bridge-placement.test.ts, src/renderer/src/hooks/use-bundled-skill-install.test.tsx, src/renderer/src/hooks/useGitHubSlugMetadata.assignee-reuse.test.tsx, src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx, src/renderer/src/lib/codex-stale-pane-account-identity.test.ts, src/renderer/src/lib/image-blob-png.test.ts, src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts, src/renderer/src/lib/work-items/linear/linear-issue-context-snapshot.test.ts, src/renderer/src/runtime/rpc/targets/use-worktree-runtime-target.test.ts, src/renderer/src/runtime/source-control/git/runtime-git-branch-client.test.ts, src/renderer/src/runtime/sync-runtime-graph/sync-runtime-graph-key-reuse.test.ts, src/renderer/src/store/repos/repos-catalog-request-coordination.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts, src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-fixture.ts, src/renderer/src/store/slices/worktrees/metadata/update-worktrees-meta.test.ts, src/renderer/src/store/slices/worktrees/metadata/worktree-meta-rename.test.ts, src/renderer/src/store/terminals/store-sleep-shutdown-order.test.ts, src/renderer/src/store/terminals/terminal-first-tab-publication.test.ts, src/renderer/src/store/terminals/workspace-terminal-reconnect-hydration.test.ts, src/renderer/src/web/web-runtime-connection-auth-framing.test.ts, src/shared/terminal/appearance/terminal-font-weight-windows-regular.test.ts, tests/e2e/claude-agent-row-view.unit.test.ts, tests/e2e/cross-version-wire/agent-permission-legacy-spawn.unit.test.ts, tests/e2e/paired-instant-browser-tab.spec.ts, tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-performance.unit.test.ts, tests/e2e/session-tabs/mobile-session-active-publication.unit.test.ts, tests/e2e/structured-agent-session-launch-admission.unit.test.ts, tests/e2e/structured-attention-prompt-relay.unit.test.ts, tests/e2e/structured-attention-read-retirement.unit.test.ts, tests/e2e/structured-chat-tab-lifetime-cost.unit.test.ts, tests/e2e/structured-session-workspace-authority.unit.test.ts, tests/e2e/terminal-agent-pane-launch.unit.test.ts, tests/e2e/terminal-parked-memory.spec.ts, tests/e2e/terminal-shortcuts.spec.ts, tests/e2e/terminal-split-activation-latency.spec.ts, tests/e2e/terminal-split-activation-latency-phases.ts, tests/e2e/terminal-split-activation-latency-main-probe.ts, tests/e2e/terminal-split-activation-latency-artifact.ts, tests/e2e/terminal-split-activation-latency-report.ts, tests/e2e/terminal-tab-switch-visual-restore.spec.ts, tests/e2e/web-runtime-session-terminal-host-authority.unit.test.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts: removes the reported wedged automation workspace without --force; clears PTY state once a failed stop is proven to have exited; names only the PTYs that are actually live, not every failed stop; warns with the specific sweep failure, not the generic deadline; still fails closed on a sweep-level failure without force. src/main/skills/bundled-skill-install/layouts.test.ts: links into a project only where its agent folder already exists; reads a pending cloud transaction as busy and a cloud receipt as another skill. src/main/skills/skill-upload-session-service.test.ts: joins concurrent disposal callers through exact cleanup completion. src/main/source-control/hosted-review-creation.test.ts: creates the pull request after fresh main-process validation passes; routes local WSL git and GitHub review creation through the selected runtime; creates a pull request on a GitHub Enterprise Server remote (#8312); creates a GitLab merge request after fresh main-process validation passes; creates an Azure DevOps pull request after fresh main-process validation passes; creates a Gitea pull request after fresh main-process validation passes. src/main/source-control/hosted-review-execution-host-routing.test.ts: reads a GitHub review on the SSH host a row names only in executionHostId; reads a GitLab review on the executionHostId host when connectionId names a different one; does not dial this client for a runtime row whose nested target shares a local name; keeps a runtime row with no nested target on this process (self-addressed stamp); keeps a legacy connectionId-only SSH row on its target; does not share a cached answer between two rows at one path on different hosts; creates a Bitbucket review locally for a runtime row rather than dialing its nested target; reports creation eligibility from the executionHostId-only SSH host; resolves the GitHub slug for a repo listing on the row it is asked about; refuses to dial a runtime host from this process; answers with the SSH target for both spellings and local otherwise; reads a runtime stamp on a row in this store as self-addressing, not a second machine. src/main/source-control/hosted-review-inflight-invalidation.test.ts: keeps other hosts, paths and their pending promises isolated. src/main/speech/model-manager.test.ts: requires pinned, internally consistent metadata for every model file; verifies downloaded model file hashes before installation; rejects non-HTTPS model downloads; marks OpenAI transcription models ready only when an API key is configured. src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts: writes to the SFTP namespace path discovered on the same session; uploads the bundle into the SFTP namespace directory; issues no discovery requests when the caller supplies no mapping; ignores a mapping on a Windows host; never resolves on the system-SSH transport; leaves writeBuffer and openFileUploadSession on the shell path; keeps the shell path when discovery is inconclusive; preserves a session-limit channel-open error unchanged. src/main/ssh/connection/ssh-connection-system-transport.test.ts: uses system SSH transport when ProxyUseFdpass is resolved by OpenSSH; allows concurrent exec commands for system SSH with an Orca ControlMaster socket; keeps concurrent exec commands disabled for system SSH without a reusable socket; uses system SSH transport for ProxyCommand targets before ssh2 auth; keeps the original ssh2 reachability error when the system SSH probe fails; reports the system SSH failure when ssh2 cannot negotiate with the host; uses system transport for target or resolved OpenSSH proxy directives; allows an environment override for e2e coverage; ignores stale imported proxy fields when fresh OpenSSH config has no proxy. src/main/ssh/orcad-migration-catalog-client.test.ts: keeps each server project’s execution host, so a nested SSH row is never read as local; reads the server’s folder workspaces and the groups that place them on a host; sends and validates the %s operation; validates an abort result without letting it erase committed state; validates a committed receipt against the requested manifest; rejects malformed stage timestamps and abort envelopes; fails closed for method absence, malformed identity, and invalid pairing; refuses a destination without the capability before sending any migration request; reads method-not-found as the same refusal, not as a lost answer. src/main/ssh/runtime-ssh-access.test.ts: persists intent then claim before connecting and publishes redacted authenticated access; names the saved dependency when dependent state blocks an SSH access link; handles lost link responses without connecting or verifying again; invalidates old transport only after authenticated access is published; rejects changed request tuple after a completed link; rejects provisioning and missing durable generations without connecting; treats a lost successful unlink response as an idempotent no-op; hashes connection identity, not display state or owner; strictly validates ports and request IDs. src/main/startup/cli-launch-redirect.test.ts: detects a launch that received the unpacked CLI entrypoint; ignores normal desktop launches; ignores the entrypoint when it is only the executable itself (argv[0]); applies on Linux too; strips injected Chromium switches before node-mode CLI arguments; keeps user flags after the command and malformed boolean assignments; does not treat a later positional entrypoint path as the launcher; redirects a direct binary launch with no AppImage env at all; strips Chromium switches node mode would reject; preserves desktop-shaped switches after the command; leaves direct serve in-process but redirects its help; treats help as a CLI launch even without a command; treats %s as a CLI launch even without a command; does not treat a value of %s as a CLI early-exit flag; does not treat a serve option value as a help request; does not reinterpret help after the argument terminator; leaves a plain desktop launch alone; skips flag values when looking for the command positional; preserves a project selector in %j; does not apply the command form on macOS or Windows; never redirects an unpackaged build; runs the in-package CLI in Electron node mode with sanitized env; refuses to redirect twice so a dropped ELECTRON_RUN_AS_NODE cannot loop; reports a missing CLI entrypoint instead of booting the desktop app; execs a direct serve into the CLI so it keeps its pid and honours profile and supervise; keeps ORCA_USER_DATA_PATH for a direct serve without --user-data-dir; serves in-process when this runtime cannot exec or the exec fails; never execs the --serve child the CLI itself spawns, or serve on other platforms; surfaces a spawn failure as a non-zero exit; re-execs a direct --serve onto X11 when Electron resolved Wayland; leaves $name alone. src/main/startup/main-process-runtime-launch-activation.test.ts: marks startup settled for the launch record only after the window has loaded and settled; loads SSH targets on a windowless serve before paired clients can connect (#25886); pins the serve listener to loopback only for orcad browser sidecars (sidecar=$sidecar, #31895); saves Codex auth before a headless serve update restart, like the desktop does. src/main/startup/run-electron-vite-dev.test.ts: forwards dev instance identity to electron-vite; prepares userData orca and orca-dev wrappers for dev terminals; consumes the stable-name flag before forwarding args to electron-vite. src/main/updater/releases/updater-prerelease-feed.test.ts: returns the newest stable tag when the user is on an RC and a newer stable exists; returns the newest RC tag when no stable is newer than the current RC; can exclude prerelease tags for stable-channel checks; probes the %s %s platform manifest; returns null for stable-channel checks when only prereleases are newer; returns null when nothing in the feed is newer than the current version; ignores entries with unparseable tags; returns null when the fetch is not ok; returns null when the fetch throws; picks semver-newest across a mixed-order feed; ignores perf-tagged prereleases for regular RC checks; reports no RC update when only perf-tagged prereleases are newer; picks the semver-newest perf-tagged prerelease; matches only literal rc.N.perf prerelease tags for perf checks; reports no perf update instead of falling back to stable or RC tags; returns a bounded fallback candidate after the newest newer tag; returns null when the only newer tag has a manifest but its asset still 404s; requires a known old timestamp for a stable-fallback tag. src/main/updater/updater-events.test.ts: hands the whole downloaded event to artifact capture; publishes manual-install recovery after a %s download; publishes the normal downloaded state for AppImage builds; blocks downloaded-state handling when the packaged marker is unusable; passes the actual updater error into the install-failure handler; keeps manual-install recovery when a later check finds only the installed release; drops the artifact when another version takes over the cycle; ignores a downloaded event for an older target; accepts a matching event when the pending cache target was cleared; drops the artifact when progress reports a different pending version. src/main/updater/updater-linux-package-recovery-actions.test.ts: rejects both actions while no package-install recovery is active; validates the retained package on every invocation; restores recovery after a recheck resolves without a terminal event; restores recovery after a recheck fails; restores recovery when a pinned check resolves to the current version; restores recovery when resolving a pinned check fails; clears recovery for both actions once the package is gone; resolves %s as a result and keeps the card usable instead of rejecting; keeps recovery available after a transient read failure. src/main/updater/updater.check-settlement.test.ts: leaves a dismissed release update on the release source; surfaces net::ERR_FAILED to user-initiated checks with a friendly message; shows checking immediately for a user-initiated check while feed pinning is pending; keeps background checks event-driven before checking-for-update fires. src/main/usage/usage-provider-store-lifecycle.test.ts: persists identities for a whole first scan with one write; skips disabled and fresh matching states; invalidates prior sources on fingerprint changes and reuses them for forced scans. src/main/window/createMainWindow-close-confirmation.test.ts: clears the quit latch when the renderer prevents unload; does not notify the crash recorder when renderer teardown follows a confirmed window close; allows close when Electron reports a crashed webContents; requests confirmation for a hung-but-alive renderer instead of bypassing. src/main/workspaces/catalog/worktree-identity-persistence.test.ts: stores independent metadata for colliding locators on two hosts; projects canonical-only metadata for exactly one host; keeps canonical metadata current for legacy writers on a known owner; removes only the selected legacy-owner metadata when locators collide; keeps the canonical identity stable when the locator changes; leaves other hosts at the old locator when one host renames its folder. src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts: leaves a journaled conversion untouched with the gate closed, %s. src/main/wsl/orcad/wsl-orcad-deploy.test.ts: holds the distro before it deploys and launches, and reports what C5 dials; passes its connect-state read (%s) on as hints; applies the SSH census and downgrade admission to the first deploy; refuses a WSL 1 distro before holding it or touching its files; tells an unregistered distro how to find the installed ones, before holding anything; surfaces an unsupported libc as the SSH host refusal does; starts an already-active slot the distro stop ended, instead of reporting it ready; deploys over an adopted unrecorded orcad under the SSH terminal gate, never a fresh launch; reports the adopted instance once the same version is serving; returns a deferral rather than launching over live terminals; hands a failed first deploy to the fresh-install cleanup before reporting it. src/main/zcode/zcode-v2-plan-credentials.test.ts: prefers migrated credentials over a stale legacy account; keeps legacy support when no personal v2 file exists; honors the upstream personal config override independently of the credential directory; does not borrow credentials from another execution host; preserves the protected Orca key priority even if v2 is corrupt; rejects upstream-invalid selection %j without legacy fallback; accepts a valid optional reasoning level; rejects upstream-invalid rule containers %j without legacy fallback; accepts a valid selected-provider empty personal rule and smart model rule; cannot establish selected credentials from %s rules; leaves encrypted CLI files unchanged across repeated account reads. tests/e2e/automation-terminal-launch.unit.test.ts: launches explicit Chat for %s through the common entry and keeps its actual fallback; does not apply stored Terminal extras to Chat; forwards only complete Chat-consumed values, with no Terminal startup base; refuses an expired admission without minting another launch identity; records the actual chat identity and delegates new workspace setup and provenance. tests/e2e/github-project-provider-columns.unit.test.ts: renders %s through one bounded items request on a named cloud host; preserves zero and complete counters: %j; preserves populated and legacy rows through shared sorting, grouping and cells. tests/e2e/structured-agent-session-launch-continuation.unit.test.ts: carries renderer lifetime through host intent to the real %s provider builders. tests/e2e/terminal-account-restart.unit.test.ts: replaces a tombstoned owner while its persisted pane binding has not yet been cleared; paired restart retains the old owner (host authority: %s). tests/e2e/terminal-hidden-view-parking.spec.ts: does not park excluded tabs; reproduces a static frame byte-for-byte across 25 park/reveal cycles. tests/e2e/terminal-long-table-scroll-restore.spec.ts: reproduces long markdown table artifacts after workspace switch and scroll; keeps narrow wrapped signer markdown table coherent after restore and scroll; keeps real emoji markdown table right edge clean after restore and scroll. tests/e2e/terminal-long-table-fixtures.ts: dedicated zero-case helper retirement; no authored test credit. tests/e2e/terminal-paste-ownership.spec.ts: Windows multiline keyboard paste normalizes terminal newlines with one PTY owner; right-click paste sends clipboard text to the focused terminal exactly once. tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts: uses WebGL by default for ordinary terminal output when available @terminal-rendering-golden. tests/e2e/terminal-windows-shell-paste-ownership.spec.ts: cmd.exe default terminal keyboard paste preserves exact content with one PTY owner; Git Bash default terminal keyboard paste preserves POSIX-shaped content with one PTY owner; WSL terminal keyboard paste preserves Linux shell content with one PTY owner. tests/e2e/workspace-board-lane-virtualization.spec.ts: mounts a window of cards for a large lane and keeps lane indexes; renders later lane indexes after the lane scrolls. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts, src/main/runtime/workspaces/removal/worktree-teardown-unstopped-pty.test.ts, src/main/skills/bundled-skill-install/layouts.test.ts, src/main/skills/skill-upload-session-service.test.ts, src/main/source-control/hosted-review-creation.test.ts, src/main/source-control/hosted-review-execution-host-routing.test.ts, src/main/source-control/hosted-review-inflight-invalidation.test.ts, src/main/speech/model-manager.test.ts, src/main/ssh/connection/ssh-connection-sftp-namespace.test.ts, src/main/ssh/connection/ssh-connection-system-transport.test.ts, src/main/ssh/orcad-migration-catalog-client.test.ts, src/main/ssh/runtime-ssh-access.test.ts, src/main/startup/cli-launch-redirect.test.ts, src/main/startup/main-process-runtime-launch-activation.test.ts, src/main/startup/run-electron-vite-dev.test.ts, src/main/updater/releases/updater-prerelease-feed.test.ts, src/main/updater/updater-events.test.ts, src/main/updater/updater-linux-package-recovery-actions.test.ts, src/main/updater/updater.check-settlement.test.ts, src/main/usage/usage-provider-store-lifecycle.test.ts, src/main/window/createMainWindow-close-confirmation.test.ts, src/main/workspaces/catalog/worktree-identity-persistence.test.ts, src/main/wsl/filesystem/wsl-drive-unc-conversion-startup.test.ts, src/main/wsl/orcad/wsl-orcad-deploy.test.ts, src/main/zcode/zcode-v2-plan-credentials.test.ts, tests/e2e/automation-terminal-launch.unit.test.ts, tests/e2e/github-project-provider-columns.unit.test.ts, tests/e2e/structured-agent-session-launch-continuation.unit.test.ts, tests/e2e/terminal-account-restart.unit.test.ts, tests/e2e/terminal-hidden-view-parking.spec.ts, tests/e2e/terminal-long-table-scroll-restore.spec.ts, tests/e2e/terminal-long-table-fixtures.ts, tests/e2e/terminal-paste-ownership.spec.ts, tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts, tests/e2e/terminal-windows-shell-paste-ownership.spec.ts, tests/e2e/workspace-board-lane-virtualization.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit1579 removes workflow/manifest/regex/private binary-header and diagnostic metric inventories, fixture selectors, injected forwarding/platform/signature/process examples, unproven overlap and internal churn counters without equivalent replacement coverage. Retains actual Git trust/diffs; filesystem hash/ELF-region/native discovery; child CLI module repair; compiler/lock/publication/rollback and synthetic Electron install/cache ownership; executable shell quoting/exit; controlled notary/timer cleanup; local patched extractor file/AST freshness; real Chromium/WebKit CSP/sandbox/HTTPS image/referrer/link/preservation controls under parsed Android headers. Five unchanged setup-pnpm/VM request-cleanup definitions reviewed and not rerun. GitHub, installer/archive, OS metric, client, native delegate, compressor, builder and Apple boundaries injected or absent where recorded. No actual native PTY, shipped full/native app, real Actions/cache/npm signature authority, downloaded Electron archive, real objdump/linker/native CLI/AppImage, signing/NSIS/notary/upload/updater or live freeze proof.",
        "Linux1.4.188 only; no macOS or Windows packaged coverage.",
        "No folder workspace, SSH execution host or live-service coverage.",
        "Other released version pairs remain untested; not a required PR check.",
        "Audit2377/2381 removes bundled-skill eligibility5 silent late-writer successful backup, layouts1 global forced backup, legacy-auto-update2 old release plus extra notes, and native-discovery7/13/18/19/21 OpenCode project, Pi home symlink, default Hermes root, requested-cwd agents symlink and standalone SSH-builder paired cwd checks. Lose those exact backupPath/bytes/global-link-lock/history/provider/label/path combinations and localized SSH-builder sample. Retained common owners are not identical replacements; no fresh validation is claimed for this reduced broad command.",
        "Audit2383 removes the complete antigravity-skill-discovery.test.ts suite. Lose the exact .gemini/config/skills path, home-antigravity source, antigravity owner, existence and contributing-root observation. Other providers exercise common discovery dispatch, not this exact catalogue row. No equivalent replacement or fresh validation of the reduced broad command is claimed.",
        "Audit2385 removes finder regular-depth and direct missing-root examples, the three-row staging-name matrix, and an initial unknown WSL-list record sample. Lose those isolated fixtures, exact backup name spellings and malformed prefix sequence; retained actual owners are not identical replacements. Missing-root case did not model disappearance after the production caller existence check. No fresh validation of this reduced broad command is claimed.",
        "Audit2389 removes whole skill-install-preview.test.ts plus destinations1 and recovery2. Lose missing-preview name/state/global identity/fixed codex+claude inventory, exact plain-global host identity return, and already-published receipt finalization fixture. No nonmutation assertion existed in preview; retained real home delivery and placed-canonical recovery are not identical complete replacements. No fresh validation is claimed.",
        "Audit2393 refresh2401 removes skill-installation original1 and only the original receiptless request case. Lose uninterrupted first-install status/exact placement count and public canonical receiptless conflict/unowned routing. Retain upstream request ownership tests and lower transaction interruption coverage byte-exact. Deleted guard case had no directory/content preservation assertion. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2397 review amendment removes whole empty-gzip, WSL provider error-mapping and remote-cancellation registry suites; two initial hostname-suffix/userinfo URL rows and initial-expired grant sample; linked-parent alias classification. Lose no-input custom gzip branch, WSL failure labels, basic registry lifecycle/duplicate-ID guard, exact hostname-suffix/userinfo input variants, prefetch expired-grant no-network and preexisting alias result alarms. Preserve the single initial wrong-port origin authorization case, original abort-after-begin cleanup/no-signal cancelUpload dispatch suite and original independent-copy modified-digest removable=false case. No equivalent complete replacement or fresh validation claimed for the remaining losses.",
        "Audit2404 removes whole skill-share-package-name.test.ts, skill-delete-plan original1/6 skill-delete-recovery original2 and skill-share-preparation original2. Lose lookup503 rejection/status propagation through prepare, explicit unblocked unordered alias-kind/canonical sample with cwd undefined, stale classification after +60000ms actual mtime change, successful first-pass single-move rollback/staged-path absence and prior-process preparation-root archive directory cleanup. Retained exact identities use cwd home; public stale guard submits timestamp1; recovery retry cases are not identical first-pass fixtures. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2412 removes whole useVirtualizedScrollAnchor.marks-restore-signal.test.ts (six fake-hook geometry/mark/convergence/user-takeover/clamp alarms), use-task-creation-draft-retention original3/4 (immediate discard mock-call count/unopened no-write), use-terminal-bulk-close-actions.placement original6/7 (absent new-agent append and one real history-publication count at consumed3/30 scale), PendingNativeChatCreation original6 (unmounted abort completion/timer cleanup), and wsl-move-dialog-store original1/9/13 (default whole-distro count/reference/reuse and rejected-preview/start refusal recovery). The history counter measures genuine publication work without entries/order/reopen assertions; its unique batching alarm is intentionally retired. Fake React scroll tests ignore dependency scheduling and cleanup; unique simulated arithmetic alarms are deliberately lost. Retained existing-terminal reorder is not new-agent append coverage; mounted handoff timeout is not abort coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2417 removes commit-actions-real-git original3/4 (ordinary clean cherry-pick and revert content, subject and current-branch samples), and pty-startup-ingress-exited-asker original8/12 (actual foreground-group read budget across100queued queries, and zero foreground reads across100normal chunks plus final emitted/accepted raw cursor equality). Counters measure actual callback work and scale is consumed; these internal-work alarms are deliberately retired. Retained unborn, conflict and sequencer cases are not equivalent ordinary-success coverage. No equivalent complete replacement or fresh validation is claimed.",
        "Audit2425 removes use-workspace-copy-status original5, which returns a fixture-supplied readError string through statusReadError. No consumer blocker or attempted branch switch established refusal; the unique error-forwarding sample is intentionally retired. Other copy ownership and stale-refresh cases are not equivalent error-path coverage. No equivalent replacement or fresh validation is claimed.",
        "Audit2432 removes BranchPicker.test.tsx original3, which only asserted onOpenChange(true/false) with an always-mounted mocked Popover. It never reopened the picker or consumed the callback in the parent status-refresh owner, despite its title. Lose that unique open/close notification alarm. Retained blocker/collision recovery and asynchronous post-unmount outcome cases are not equivalent replacement coverage. No fresh validation of the reduced selector is claimed.",
        "Audit3086 source-only reduction (3079/3080/3081): intentionally retire 93 authored/100 expanded mock-boundary cases, including the complete spawn-errors and SSH reconnect overlay suites, without replacement. Retired alarms include spawn classification/ownership, reply ceilings and renderer-write failure recovery, disconnect/detach fencing branches, authority facts, and overlay retry/visibility wiring. Retained callbacks are unchanged; no fresh execution, real PTY/SSH, rendered UI, or performance result is claimed.",
        "Audit3096 source-only reduction (3087/3088): retire 69 authored/76 expanded cases, including complete recovery-portals and reconnect-banner suites. Intentionally lose dead/default TUI replay, generated alternate-frame style composition, reset/mode/dimension and legacy missing-mode-boundary alarms, UI notice/action/reveal policies, and isolated recovery lifecycle variants, without equivalent replacement. Retained registrations and callbacks are unchanged; headless cells are not pixels, and no fresh runtime, host, SSH, WSL, rendered-app or performance result is claimed.",
        "Audit3108 source-only reduction (3094/3095/3100): retire 27 authored/30 expanded cases, including complete markdown view-state, file-preview link-open and CLI agent-server-route suites, without replacement. Deliberate losses include preview visibility/reference lifetime and same-path owners; SSH stat, directory/missing-target, explicit-null owner, nonmarkdown line/column, local URI routing, remote-to-client guard and same-file reuse; document-preview source-owner/folder/reuse routing, stable grant location and outside-workspace POSIX/Windows request projection; and verified remote CLI send/check refusal, suggested --on argv/copy, shell no-probe bypass, unverified-launch admission and older-peer refusal. Retain two markdown source-runtime/qualified-reveal alarms, one stale grant-rejection fence and two remote read/mutation evidence policies, with original callbacks. Final last-wins reveal did not prove transient cancellation; CLI prerequisite did not prove no real send, and envelope tests do not execute server refusal. No fresh runtime, rendered UI, actual file/SSH/paired transport, authorization, mixed-version or performance result is claimed.",
        "Audit3114 incorporates source3101: retire three structured Claude child-environment wrapper cases covering inherited stamp isolation/default and explicit entrypoint, Windows SDK-key canonicalization/default/duplicate-key order, and configured lookup/final environment/config-dir conjunction. Keep direct auth/session sanitation and Windows-versus-Linux overlay checks, actual executable lookup from supplied inherited PATH, native Windows child environment delivery, and stale option-mutation fencing. These are not equivalent replacements for the retired wrapper alarms. No fresh test/runtime, real login-shell probe, Claude SDK startup, remote/mixed-version, UI or performance result is claimed.",
        "Audit3114 incorporates source3105: retire 17 authored/20 expanded daemon launch-note cases, including the entire two-case SessionLaunchNote suite. Deliberately lose split-marker carry across same-token re-arm, stale-token retirement refusal, foreground tri-state and serial settlement, omitted-note/no-incarnation mixed-version policy, sticky retirement, first-incarnation/replacement launch preservation and held-launch precedence. Keep only the unchanged unresolved foreground-read race against a later finished attach. Supplied notes/foreground and runtime calls do not establish actual daemon/main restart, SSH, native Windows observation, mobile UI, equivalent replacement or fresh runtime/performance validation.",
        "Audit3114 incorporates source3109: retire six authored/35 expanded pricing cases: 21 accepted model-name examples, 10 unsupported/future-model fail-closed examples, malformed TTL clamp, unknown-model estimate refusal, flat-model long-context disregard and oversized long-context clamp. Keep mixed five-minute/one-hour write allocation and short/all-long/mixed long-context allocation with original fixed oracles. Real parser/refusal/bounds alarms are knowingly lost without equivalent replacement; retained tests do not validate provider rates, actual billing or request threshold classification. Preserve the archived usage-scan-append source-freeze receipt without transferring historical execution/performance credit. No fresh runtime result is claimed.",
        "Audit3128 scoped coverage reduction: Audit3121 removes VoiceDictationLanguageSetting.test.tsx (Spanish-to-es callback and unsupported-model Korean option presence) and voice-speech-model-rows.test.ts (provider/language-order/retired-on-disk list policy); these real narrow alarms are deliberately retired without replacement. VoiceSpeechModelSection per-model concurrent deletion remains unchanged. Audit3122 removes the direct absolute/parent-segment sparse-directory exception-type sample and the five-row IPC sparse-preset error-code/non-save table (two authored/six expanded cases). Those real typed-validation and IPC refusal/error-code alarms are deliberately retired. Keep both real symlink/junction floating-directory trust cases and the minimal RPC structured validation-reason serialization case. The RPC case does not replace IPC save/refusal behavior, typed normalization for both path inputs, actual Git sparse checkout or rendered localization. No equivalent replacement or fresh test/runtime/platform/remote/performance validation is claimed. Audit3124 removes ExperimentalPane.test.tsx (ordinary Pet switch callback), WorkspaceDirectorySetting.test.tsx (padded absolute saved-path normalization/no-write blur), and repository-search.perf.test.ts (navigation/selected-pane builder-call policy, fixture cardinality/nonempty entries and renamed project keyword inclusion). These real narrow alarms are retired without replacement; RepositoryPane.search.test.tsx search-to-sparse-editor request remains unchanged. Audit3129: resolver Windows case-insensitive and POSIX case-sensitive configured-env composition plus mocked-base launch-preflight Windows composition are intentionally no longer checked by the two deleted suites. No equivalent coverage claimed. Keep runtime-structured-agent-host-env.test.ts unchanged: configured Windows Claude-home account identity and host-account precedence remain checked.",
        "Audit3146 combines source reviews3132/3133/3135/3138/3143: intentionally retire20authored/31expanded cases without equivalent replacement. Provider-session losses: structured-native terminal-resume exclusion, metadata-less completed identity, new-turn completion clearing, Pi provider-only/periodic/manual promotion, changed-transcript launch-config isolation, Pi/omp/prime-agent completed-session remote/manual-shutdown promotion, and quit/done precedence over heartbeat. Side-thread/question losses: finished-pane acquisition, hidden title/recap states, local/relay/relay-done conversation takeover with prompt/session/child resets, plain-message abandonment, compaction/session replacement and completion resets. Codex startup losses: incoming-owner cached child replacement, old-relay foreign live-session correction, completed foreign-root turn-fact permutations. Transcript losses: real temporary-JSONL partial sibling/final-child completion, unlabelled child attribution, compact cached replay preservation and100/1000completed-child roster retention/release. Compiler-ratchet losses: valid-line uncompiled-list parser grammar examples and injected-existence stale-path filtering; these did not exercise actual filesystem canonicalization or build exclusion. These are real lifecycle, ownership, replay, liveness and retention alarms, including recent#40246 regressions, deliberately lost. Retained conditional record replacement, clockless root/SSH owner isolation, persisted main-thread fork rejection, partial/final question-answer lifetime, cached-roster/missing-ID/live HTTP/durable startup boundaries and restarted-relay refusal/acceptance do not replace those losses. No native/SSH/WSL execution or equivalent coverage is claimed.",
        "Audit3156 combines3147/3150/3152/3153/3154: deliberately retires39authored/40expanded native-chat recovery cases, eight whole suites and two orphan test-support files without equivalent replacement. Lost alarms: lost-reply unconfirmed reconciliation, skipped rows/counts and missed-frame repair, unknown/pending outcome and omitted-failure-list compatibility, uncertain history after dismissal, retry/refusal/dismiss lifecycle, hidden/consumed picker ownership, result-tree keyboard focus/disclosure and all-skipped retirement; unconfirmed-over-conflict guidance and failed-chat changes despite older host timestamps; nearest-listed ancestor/cyclic forest shape, descendant membership, host ordering/missing-host local fallback; skipped/readiness/admission counts, provisional skip/progress monotonicity, early per-chat verdicts with batch pending protection, older-host waiting, start-slot/delivery distinction, retry-over-failure and unknown-after-withdrawal attention; remote snooze/reconnect/reoffer, unseen mixed summary through open/close, watched completion retirement, new success beside old failure, failed-reread mixed-result preservation, filter/collapse completion resets, retry summary replacement and current-offer/history selection; cross-host workspace identity, rendered cyclic reachability, nested tri-state/toggle propagation, project eligibility isolation and collapse preserving selection. Exact fallback-list completion barrier, batched verdict/cleanup retention, stale-read versus dismissal publication race, and requested-but-never-rendered finished-run retirement remain; they do not replace retired alarms.",
        "Audit3165 combines source3160/3162: deliberately retires six authored/expanded cases across three whole suites without equivalent replacement. Launch/status losses: observed React-render pending/resuming coordination across settings and deferred offer read; stale-offer reread suppressing dialog reopen; held-local-chat recovery visibility with new-chat preferences off; disabled-local admission avoiding offer RPC despite an injected but unconsumed paired-tab fixture; and run-only lost-reply uncertainty reachability until direct viewed-run retirement. Launch probe does not prove arbitrary synchronous-store atomicity, the paired fixture is not remote runtime enrollment, and the status case directly marks viewed state rather than rendering the summary. Crew-hook losses: old-host method_not_found cache persists across party changes but is released by independently supplied connection generation/verified pairing status or pairing revision, with actual frame publication and teardown. These are real narrow coordination, admission, uncertainty and mixed-version cache alarms consciously lost. Exact web verified-runtime writer handoff guard remains; it does not replace those alarms or prove live host/native/mobile delivery.",
        "Audit3178 combines source3169/3170/3175: deliberately retires eight authored units (six Vitest cases and two imperative custom relay scenarios), including two whole suites, without equivalent replacement. Voice Section loses per-model pending-delete isolation across interleaved A/B completion and the two-success refresh-call alarm; exact VoicePane delayed key-clear/newer enabled-toggle merge remains and does not replace row deletion coverage. Speech loses dedicated rating-scale/inclusive-ceiling, unsupported-versus-unmeasured, explicit/system-language precedence/locale alias, accuracy versus fast named/default/best-measured selection, and unmeasured/no-match examples; exact offered-user-pick versus retired-selection case and its fixture remain. Relay loses legacy ping-delivery count/liveness sampled before the silence deadline and grouped malformed Bearer/host-ID 401/429 routing checks; twelve real Worker/DurableObject/shipped-client scenarios remain, not equivalent replacement for those narrow alarms. Six prior speech cases are not all deleted: approved successor3175 keeps the original user-choice case. No actual credential/file persistence, native/GPU/engine/download delivery, production assignment policy or deployed-runtime validation is claimed by this reduction.",
        "Audit3191 combines approved source3182/3187/3188: deliberately retires thirteen authored Vitest registrations and fifteen expanded cases, including five whole suites, without equivalent replacement. Attachment intake loses real portal/native-capture terminal interception and unowned-container refusal, immediate child-only committed availability/claim-ref negotiation and delivery, and direct-target over stable focused/background composer routing through disable/re-enable/remount and independent question focus. Exact destination/cache/draft and final-stat owner/workspace/File-release suites remain; they do not replace Surface recipient routing. Automation authoring loses destination runtime catalog membership, local/direct-SSH exclusion of paired-runtime repos, unknown-runtime empty catalog, logical project/host/setup/repo/path context payload, and missing/nonready setup refusal; these were genuine direct helper alarms, while exact schedule transformation, legacy schedule and setup-decision suites remain. Agent picker loses setup-chat/terminal/missing-installer/unsupported-or-unknown-host row projection samples and the ordinary unsearched menu variant; the entire original26-line resume recipe suite remains, including reported bypass versus default/absent permission modes, as does the exact search-result menu callback with its fixtures, model/effort commits and staged Arguments reopen outcome. Rejected predecessor3180 full recipe deletion is excluded. No actual native drag/cursor/focus/IME, upload bytes or disk/restart persistence, full automation save/scheduler/runtime transport, real resume-process flags/environment delivery, or native menu/rendered layout validation is claimed.",
        "Audit3200 composes approved source3194: deliberately retires thirteen authored registrations/twenty-seven expanded cases in six whole automation host/list policy suites without equivalent replacement. Real RPC category/retryability and wrapped-timeout recognition, unscoped-failure/scoped-success health evidence precedence, exact-ID create selectors and per-run workspace omission, paired-web local/SSH/absent host catalog routing, incompatible/removed/unhydrated/offline execution health, runtime-before-nested-SSH recovery dispatch, and no-owned-focus/successor/foreign-list focus policy alarms are consciously lost. Retain exact20line orphan allow/refuse/precondition and exact90line cross-host same-ID search suites. No retry-timer/fence lifecycle, actual reconnect/network/write delivery, native focus, mobile/mixed-version runtime or disk persistence coverage is claimed.",
        "Audit3209 composes approved sources3202/3206: deliberately retires seven authored/expanded cases in four whole suites without equivalent replacement. Work-item queries lose real GitHub/GitLab oversized ASCII secret-prefix empty-query and whitespace-before-trim refusal alarms; inputs share the imported size bound and exercise only its fast length branch, with no multibyte or actual provider/exposure guarantee. Skill sharing loses complete/partial managed-bundle and destination-ambiguity association checks plus three negative origin/path/scheme admission examples; these do not establish uploaded contents, arbitrary-URL fetching, authorization or execution. Retain exact originless-project direct-link fallback, cloud-delete confirmation, bundled-target repair/owner isolation and explicit Windows-host preference over stale WSL suites. Rejected3201 runtime-preference removal is excluded. No real cloud/network/host/disk, mobile or mixed-version execution validation is claimed.",
        "Audit3219 removes the synthetic Cmd+J extra-source suite; this broad command no longer checks its match/tie placement and selection, announced count, empty-query cap, or workspace hiding with retained recent tabs. No replacement coverage is claimed.",
        "Audit3231 retires supported-host restore-pane key mapping, closed/open creation-sidebar toggle visibility, unrelated scope-error/null classification and quick-submit reveal/no-create checks. These broad commands lose those real narrow alarms; no replacement coverage is claimed.",
        "Audit3246 retires NewRowsMarker reveal/no-repeat and pane-scoped beforeinput checks; skill-owner option availability/count/dedup/order; six styled Input/Textarea IME forwarding rows; the static Codex/OpenCode smart-key inventory; tab-map AST ratchet diagnostic fixtures; child-roster work-budget and retained-aggregate alarms; malformed persisted floating-cwd fallback/no-crash/empty exact-root checks; the unanswered-host empty-list discriminator; the direct invalidated-cache commit-false assertion; one redundant digit-keyup IME row; cached non-supported Claude title-generator rows; and the duplicate late naming-result singleton. These root broad commands lose those specific alarms without equivalent replacement. Distinct retained owner/state checks have their own bounded claims; the real scheduler still rejects stale response data, while the direct false-return alarm is retired.",
        "Audit 3256 removes these specific alarms from the broad root unit commands: skill dialog active-share selection, close and pending-share handoff; simple keyed-record deletion; marker live-region insertion, simple landing and nine baseline policy examples; General search/control navigation inventory; orphan-count cache bootstrap; seven Codex code classifications and HTTP 429 warning mapping; two skill unread-root verdict examples; peer-mail payload and conversation-ID rejection; and the GitHub organization TABLE text-field optimistic rollback/failed-envelope example. These include real behaviors; retained tests do not provide equivalent coverage for every removed scenario. Mobile losses are recorded separately and are not coverage of these root commands.",
        "Audit 3273 removes 14 authored declarations and 19 expanded scenarios across four whole suites and eight partial suites. Retired alarms cover saved-local cancellation/layout ownership, ambiguous-owner warning reset, folder attachment routing, VM false-capability bypass, abandoned reveal warmup cleanup and viewport claim deduplication/rearming, quiet unrelated remote-removal refusal, startup-command one-shot consumption, repository/floating recovery-ledger rows, fake-React pinned-scroll intent, split-ratio state identity/subscriber suppression and fractional change, cross-host project-group join refusal, three PR request-lifetime permutations, upstream-status preservation on error, and unresolved Git-owner refusal. These regression checks are intentionally lost under the test-value audit; retained scenarios are not equivalent replacements. Historical coverage receipts remain historical, including gate35 subscriber claims.",
        "Audit 3283 removes 20 authored declarations and 31 expanded scenarios, including two whole suites. Retired alarms cover PR refresh-state pruning, shared runtime subscription cleanup and store isolation, language content-change routing and older completion ownership, ordinary panel retry-timer cleanup and pending loading, four hosted-review lifetime permutations, mocked terminal creation error/order wiring, five sleep-inventory variants with pending-frame-only assertions, palette fallback/composite highlights, Windows/UNC encoded-editor input rows, mixed-repository partial failure counts, title setters and generated-title bypass/replacement, five window-close coordinator delegation/guard/finally branches, and ambiguous-old-record frame reveal. These regression checks are intentionally lost under the test-value audit; retained cases are not equivalent replacements. Prior coverage notes and receipts remain historical.",
        "Audit 3292 combines adopted 3285/3287/3289/3293 removals: 40 authored declarations and 47 expanded scenarios, including whole frame-editor-view, ambiguous remote-delete-refusal, unverifiable-host subscription and editor-close cleanup suites. The previously reviewed dock-badge suite was already removed upstream in PR 40895 and receives zero new removal credit. Intentionally retired alarms include background browser selection and last-tab landing; main startup fallback, SSH project cleanup/survivor routing, exact-PR contradiction/saved-push positives, replay/sidecar rollback and wrapped remote error normalization; records/snapshot missing-diff hydration, ambiguous folder-owner delete refusal, focus no-op notifications, nested editor context-only cache check, pending broadcast-first status and ordinary four-confirmation aggregation; preview-source frontmatter pruning, approved local/runtime agent dispatch, non-GitHub legacy PR cache invalidation, stale merged-head transient-error fallback, empty-queue immediate query reply and unverified-to-concrete preflight risk. Additional intentionally retired alarms are injected host subscription/unsubscribe counts, synthetic editor reveal/draft/fallback/scoped close, ambiguous unread refusals and hidden mark/read roundtrip, immediate connect backoff/noError, positive mirrored evidence-clock renewal, supplied VM failure/success projections and git-local/folder-SSH wake permutations. Remaining temporal/ownership cases are narrower; no equivalent replacement or fresh execution is claimed.",
        "Audit 3301 combines adopted source batches 3296 and 3299: retire 27 authored declarations and 36 expanded scenarios, including six whole suites. Intentionally lost alarms cover failed-verification/recovery/restart counters and mocked hosting/toast; early overlapping pane-read scheduling/count; unreadable removal listing draft guard; bulk-purge remote-qualified and raw-local guard maps; initial-snapshot blank/mode/oversize/printable/fresh-spawn callback and replay examples; fallback mobile file close and ordinary MRU; default queue overload/drain; seeded browser-page reuse and supplied missing-page URL recreation; ambiguous sleep/hibernation owner refusal and untouched bindings/origins; ordinary selection/activity/fallback priority; skip-remote success and retained hints; supplied structured-chat unsent retention and scoped removal draft eviction; caller-chat focus precedence; open/draft PR cache eviction and merged-head fallback result inventories. Retained adverse-ordering and ownership cases are narrower and do not establish equivalent replacements. No fresh runtime, native, physical provider, cross-platform, mobile or mixed-version evidence is claimed.",
        "Audit 3312 composes adopted sources 3302 and 3308: deliberately retires 33 authored declarations and 36 expanded cases, including the whole backend startup-focus, active-browser IPC-close-routing, remote-browser-creation and agent-terminal-presence suites. Intentionally lost alarms cover distinct six-pane reconnect handles; SSH host label/Connect callback, unhydrated visit cleanup, repo cache aliases and hidden worktree/tab/PTY cleanup; adopted-agent startup focus and viewer navigation/reuse; staged, pageless, source, stale and orphan browser-close routing; web local-materialization refusal, desktop incapable-host fallback, failed/thrown remote creation and paired-web sign-in refusal; BOM/NUL and remote/local custom-editor byte-read examples; immediate folder activation and unread clearing; and batching idle/coalescing, accumulated byte ceiling, leading-edge-disabled, standalone synchronous oversize rejection, validation yield, deferred pending-tail order and both viewport-clear examples. The newly reintroduced agent-terminal-presence suite also loses actual terminal-status membership positive and nonterminal-status callback suppression alarms, including the recent 40916 guard regression; the older different 2133 presence-suite history remains historical and receives zero duplicate removal credit. These real regression alarms are intentionally lost. The unchanged survivors provide narrower coverage, with no equivalent replacement or fresh gate, provider, rendered, remote/mobile, mixed-version, cross-platform, soak or measured-budget validation claimed.",
        "Audit 3318 composes adopted sources 3310, 3313 and 3317: intentionally retires 71 authored declarations and 102 expanded cases, including whole terminal-detach agent-retention, seeded batch/single open-files equivalence, shallow context-menu shortcut-badge, mocked active-workspace delete-dispatch, workspace session hydration, SSH target cleanup, editor session hydration and worktree terminal purge suites. Lost alarms include chained transfer alias and immediate close/exit retention; batch/single divergence, survivor/selection/map preservation and input nonmutation across 400 imperative seeds (one registered case); disconnected pending-handle retry, authoritative absences/close-record shortcut/older-host absence and published-presence/unpublished-frame examples; published empty host-graph omission to pane exit; legacy search ranking/exclusion fallback; provider request upgrade/dedupe/finalizer ownership; asynchronous PR suppression/primary-change and same-number different-repository URL rejection. Deletion routing loses host/instance qualification, paired and legacy mapping, folder ownership, active-versus-hover/menu-row selection, ambiguity, modal/editable/creation/view/main/deleting/missing guards and shortcut advertisement. Unchanged real keyboard/hover/confirmation/catalog E2E remains narrower, not an equivalent replacement. Additional losses include scripted old-host disk/UTF-8/noop/baseline and landed/unlanded lost-reply/replacement-retry outcomes; ordinary/repeated healthy-link reattach; cross-owner terminal/chat binding; oversized replay permanent-unavailable classification; floating reveal keyboard ownership/close/disable/listener disposal; naming/retained-turn/Sleep/error/close/reject status tables; SSH membership prune/new-target-only reads and environment/local bucket isolation; same-frame receipt capacity and positive bare/headless publisher readmission. These actual regression alarms are deliberately lost; no fresh gate, provider, rendered, mobile, mixed-version, cross-platform, soak or measured-budget validation is claimed.",
        "Audit3335 composes adopted source unions3327/3328 and3330/3332: intentionally retires100 authored registrations/123 expanded cases, including ten whole suites, without equivalent replacement. Lost alarms include seeded host persistence/contention and stale-host cleanup; browser snapshot assembly; mocked wake/DPR callbacks and frame budgets; preflight projections; palette authority/cache suppression, URL intent and saved-title cross-repo collisions; metadata coverage/set patch and dropdown assembly; and removed terminal, worktree, review-refresh and owner-routing examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI/GPU/focus, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain only their original scope.",
        "Audit3342 composes adopted source batches3333/3334,3336/3337 and3340/3341: intentionally retires180 authored registrations/263 expanded cases, including seven whole suites, without equivalent replacement. Lost alarms include corrupt editor hydration; mobile editor/diff publication and privacy projections; stale-resubscribe routing; model-picker projection/refetch/retry/fallback; editor check-details and frame property inventories; latched-pane cleanup/quiescence; client create replay identity/options/compatibility; and removed owner, async routing, terminal and layout examples. Retained definitions do not replace these alarms. This broad root unit command selects the reduced suite; no fresh execution, historical source/import equivalence, real provider/network/SSH, rendered UI, durability restart, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts keep their original scope.",
        "Audit3349 composes adopted batches3343,3345 and refreshed3354: intentionally retires234 authored registrations/294 expanded cases, including13 whole suites, without equivalent replacement. Lost alarms include supplied terminal reconnect/replacement/typeahead/mirror/result and snapshot examples; synthetic render-desync persistence/recovery; worktree listing/owner/catalog/lineage/removal and activation/creation examples; host-scoped PR and task-record projections; editor diff/status/comment and UI send-target examples; automation observation/wake, supplied sleep/deadline clock and native-chat completion/notification/relaunch samples; held-tab layout and cleanup/progress guard examples. Retained adverse-ordering and wire-boundary cases are narrower and do not replace all removed alarms. The already-upstream visibility-resume deletion receives zero new removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH, native process/power/GPU, rendered UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3359 composes root-adopted source3355/independent3356: intentionally retires130 authored registrations/139 expanded cases, including eight whole suites, without equivalent replacement. Lost alarms include strict create naming/capability/legacy payloads; supplied transport host replacement, deadline reattach, create-handoff and split activation; agent-session fork/clipboard/platform flags; shutdown cleared-scrollback/unmounted bindings; simulator host-collision/selection/shutdown; and removed editor, catalog, mutation, launch and status examples. Retained12 adverse-ordering/state-consequence cases are narrower and do not replace all removed alarms. Two queue absences receive zero removal credit. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY, filesystem restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3362 composes root-adopted3358/independent3360: intentionally retires129 authored registrations/140 expanded cases, including four whole suites, without equivalent replacement. Lost alarms include supplied orphan-adoption retry/malformed inventory/cancellation; fake-terminal replay parser/wedge/disposal callbacks; all-host catalog metadata and Windows preferences; host keepalive/protocol/stale/settings failures; and removed exact-stop/suppression, source save lifetime, diff-note queue, rename/editor close, input flood/chunk refusal/limits, purge and creation examples. Retained18 registrations/21 expanded cases protect narrower ownership, generation, dirty-state, queue convergence, encoding and attachment-lease outcomes. No replacement or keeper quota claim. This broad unit command selects the reduced suite; no fresh execution, historical import equivalence, real provider/network/SSH/PTY/xterm parser, disk restart, native UI, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3368 composes root-adopted3363/3364 and3367/3369: intentionally retires181 authored registrations/196 expanded cases, including28 whole suites, without equivalent replacement. Lost alarms include hibernation attention/liveness/backoff/sequential teardown and inventory, host launch compatibility/legacy/Kimi/resource cleanup, terminal recovery parser/pause/quarantine/remount, window-visibility omission-fence lifetime, launch-option rendered Start, sleeping-resume saved recipe/WSL quoting/cancellation, plus removed project/window/input variants. Additional tiny-suite losses include sentence/label/field/default inventories, credential omission, Windows argument/environment mapping, URI decoding, diagnostics, provider classification and fake-clock callback/parser examples. Retained ten registrations/twelve expanded cases include two literal Unicode Mn/Cf zero-width range guards in the actual character-range algorithm and protect narrower delayed editor bytes/destructive ownership, mounted hidden collision repair, ten transport epochs, duplicate-command refusal, caller timeout typing, executor unknown-opener refusal and failed-chunk user bytes. This broad unit command selects the reduced suite; no fresh runtime, real provider/network/PTY, filesystem restart, native UI, historical import equivalence, mobile, mixed-version or cross-platform validation is claimed. Unrelated dated receipts retain their original scope.",
        "Audit3375 composes root-adopted3370/independent3371 and3373/independent3374: intentionally retires79 authored registrations/84 expanded cases, including39 whole suites, without equivalent replacement. Lost alarms include federation field/parser inventories; Claude rejected-key precedence, credential clone redaction, managed-versus-user hook preservation and CLI defaults; setting/status/activity projections, mocked SSH/notification/reveal/Linear refusal, fake-clock reconnect and noise; image-fold artifact visibility, paste eligibility, setup trust, scripted ACP error-to-journal publication and ligature cache tuple aliasing; plus supplied folder-runner uniqueness, mobile host-overlay/credential/update/preference races, status/markup/title/keyed-row projections, subscriber cleanup, cancellation/close/refusal/link-issue and mirror suppression alarms. Retained3373 merger contiguity, dual-clock overdue-resume exactly-once, rejected-paste IPC sink and annotation schema roundtrip remain bounded. Retained actual HTTP/OSC status composition, destructive sibling-filesystem isolation, external contrast invariant and fixture CSS pixel intervention remain narrower. Original reviewed87authored/92expanded become9/9; current OpenCode suite adds two preserved upstream cases and the synthetic-title suite gained one Cursor policy mock-call case, independently reviewed for removal in root3378; current90/95 become11/11. That Cursor suppression/ready-frame regression alarm is intentionally lost; it does not observe native title ownership or tab flicker. For3370 only the peer was independently blind, with author exposure explicit;3373/3374 both blind pins were verified. This broad root unit command selects the reduced root unit suite; UNIT_INCLUDE excludes mobile tests, which require the existing mobile runner; retained Playwright component-pixel spec uses its separate existing headless fixture runner and is not validated by the broad unit command. No fresh execution, actual agent/shell/provider, OS material/focus, historical import equivalence, mobile, mixed-version or cross-platform evidence is claimed. All dated receipts retain their original scope.",
        "Audit3381 composes root-adopted3376/independent3377 and3379/independent3380: intentionally retires436 authored registrations/670 expanded cases, including79 whole suites and12877 test lines, without equivalent replacement. Lost alarms include scheduling, account/host/status/filter/format inventories, microphone/image cleanup, title/bell/capability lifecycle routing, access/impersonation/outcome matrices, paste/input resend/ledger/retention, stale completions/reload containment, trust-read failure and popup OAuth/security/geometry vectors. Retained30 registrations/34expanded cases in22 suites preserve narrower SQLite TEMP/TZ/WAL, HTTP transcript root resume, mobile original-index Choose/Submit, child environment/Git lock expiry, stale ACK/PTY lifetime/peer fairness/durable replay/output ordering, actual DOM paste/editor focus, DEC2026 conservation, filesystem rollback, owned buffer lifetime, actual OSC parser/tracker handback, POSIX Python UTF8/fallback, durable trust concurrency/version, OpenSSH verdicts and hidden Chromium POST/route lifecycle. Mocked boundaries limit claims. Current bounded defining-owner reads preserve the retained oracles; captured identities are not full transitive semantic review. Both component blind pins authenticated before exchange; final reconciliation and explicit postpin3380reason correction supplement control, without retroactive blind claims. Root unit command excludes mobile and separately admitted Electron probes; use existing respective runners. No fresh execution, native focus/device/pixel UI, live SSH/remote, equivalent replacement or broad mixed-version/cross-platform validation is claimed. Prior dated receipts retain exact original scopes.",
        "Audit3390 composes root-adopted3382/independent3383 and3386/independent3387 and3388/independent3389: intentionally retires216 authored registrations/230 expanded cases in42 whole authored suites plus5 zero-case registration drivers, without equivalent replacement. Lost local alarms include fake PTY identity/routing/startup/replay/mode/title/mouse/IME/scroll matrices, broad startup identity and file-open wiring, mock mailbox title recovery, mobile row parity and whole-v-selective save parity. Retained24 registrations/26 expanded cases in22 suites preserve actual xterm Windows buffer/wrap/scroll, typed TOML scalar, real Promise cancellation/settlement, HTTP Codex scanner/projector semantics, durable recovery admission/newer-schema bytes, federation completion/ACK/SQLite atomicity and failed stale-run-write versus imported durable history. Additional retained clock-domain scheduling, durable freeze/ACK/checkpoint ordering, ABA dirty intent, SQL atomicity, folder-domain retier/last-note deletion, scrollback durable no-sync staging, PanelBridge subscriber lifetime and reserved-send publication preserve narrower concrete behaviors. Current finite owner drift assessed in bounded defining bodies; retained callback bytes unchanged. Historical notes and complete dated receipts keep their original exact scopes. No new execution, equivalent replacement, native focus/device/pixel, live remote or global mixed-version guarantee is claimed.\nOriginal active selector fields (historical raw native JSON values; not current coverage):\ncommands: [\n        \"gh workflow run packaged-browser-e2e.yml\",\n        \"pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project=electron-headless --workers=1 --repeat-each=3 --retries=0\",\n        \"gh run view 34069063016 --log\",\n        \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=2 --reporter=dot\"\n      ]\ntestFiles: [\"tests/e2e/packaged-mixed-version-browser-placement.spec.ts\"]\nassertionRefs: [\n        {\n          \"file\": \"tests/e2e/packaged-mixed-version-browser-placement.spec.ts\",\n          \"assertions\": [\n            \"old client and old host lack client-host and browser-tunnel capabilities\",\n            \"browser contents remain owned by the server and the expected snapshot marker is readable\"\n          ]\n        }\n      ]",
        "Audit3403 composes root-adopted3393/3394,3400/3401 and3398/3399: intentionally retires167 authored registrations/196 potential expanded cases across93 whole suites without equivalent replacement or fresh execution. Retained65 registrations/79 potential cases include one conditional missing-input failure sentinel; potential counts are not executions. Historical notes and complete dated receipts retain their exact original scopes. The broad root-unit command loses the UNIT_INCLUDE src/ subset of retired examples; mobile is outside UNIT_INCLUDE. Other lost alarms are recorded by the adopted per-case source reviews.  Original scope text is retained as the exact suffix of coverageNotes/oracle; historical evidence is unchanged.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Broad root-unit discovery loses35WSL examples,22STT examples,22shared-server-banner examples,18clipboard-handler examples (whole suite deleted),14VM lifecycle examples and16commit-message cancellation examples. Retain4WSL and7STT mocked connector/worker cases,1rendered stale-banner refusal,2VM guard/failed-compensation cases and1late-stream ownership cancellation case; real WSL/microphone/remote-provider proof is not established. Separately discovered e2e-unit drivers lose13cross-version-wire local cases and15mobile active-publication cases, keeping same-process disk-reopen/new-host cursor content/epoch/sequence outcomes and a host/renderer-snapshot selection and inventory revision race respectively. Imported released stop-note scenarios remain unchanged and receive no duplicate credit. Cloud suites are outside root UNIT_INCLUDE.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes.",
        "Audit3417 composes root-adopted3415v2/independent3416v2: intentionally removes117authored/173potential expanded registrations from12semantic sources, deleting4whole conventional suites and3registration modules and retaining4authored/5expanded cases, without equivalent replacement or fresh execution. Broad root-unit discovery loses naming/title/queued-host fixtures, main-window focus-shortcut and attach-services mock orchestration, Git Bash console-capacity fake process inventories, most real-Git preparation/locking variants and Claude/Codex catch-up examples. Keep lifetime rejected-writer followed by late termination proof and autonomous real-checkout cleanup; two-row real-Git rollback after a real move preserving a replacement/admin marker or revoked permission; a live translator write during a held transcript read fencing stale Claude history append; and Codex expected-item revision rejection before a historical writer shim. Codex driver registers retained bounds exactly once with original inputs; bounds does not prove modern writer persistence. Accepted changed-lock preflight sentinel and omitted-parent routing losses are not replaced.  All earlier notes and dated/archived evidence retain original scopes.",
        "Audit3425 composes root-adopted3420/independent3421: intentionally removes83 authored/112 potential expanded registrations across13 semantic sources, deleting7 whole conventional suites and1 registering helper;7 authored/10 potential expanded cases remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted mock orchestration, refusal, restart and storage examples. Retain unchanged two-phase real-WSL deployment/survival, the reduced idle-release holder proof without restart/first-output measurement, real worker stop/release cleanup barrier rows, physical Git branch-preservation rows, and SSH disconnected-close proof. Other SSH and CLI variants and WSL telemetry/warmup churn are intentionally removed.  Earlier notes and dated/archived evidence retain original scopes.",
        "Audit3429 composes root-adopted3426/independent3427: intentionally removes168 authored/205 potential expanded cases across16 semantic sources, deleting11 whole suites and one304line unused assertion helper. Five authored/five potential cases remain; the duplicate500k graph row is dropped while its50k row and callback remain. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses the adopted migration/recovery/federation/rich-draft/paste/automation/mobile/catalog examples. Keep server-edit preservation during migration, native supervised cancellation holding the agent home until physical stop, pagehide lost-text preservation, graph old-result WRAPPER WeakRef collection with50k rows, and mobile React render isolation. The WeakRef does not prove all commit objects are collectible or a memory budget.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3437 composes ROOT-adopted3431/independent3432: intentionally removes127 authored/174 potential expanded cases across12 sources, deleting7 whole suites and one267line unused helper without test credit. Retain8 authored/13 potential cases. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses reduced or deleted relay, coordinator mail, recovery watchdog, automation observer, launch picker, folder PTY, profile restart, web migration, retirement, pointer delivery, agent-row and run-bound mailbox examples. Retained checks cover relay hello/payload and SIGTERM drain, coordinator pending-check and clear-to-Run continuity, profile persistence, the full six-row web merge table and real run-bound delivery waiter. These do not replace removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3446 composes ROOT-adopted3441/independent3442: intentionally removes100 authored registrations/119 potential expanded cases (118 conditional-active before platform gates) across16 sources, retaining11 authored/13 expanded cases and deleting6 whole suites. Two parent registrar import/call cleanups and the unused68line CLI recording fixture carry zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit and mobile discovery loses interrupt/wake registrars, task storage/session-close/account snapshot hooks, permission tables, copy/preference/model-discovery/composer examples, launch placement examples, VM projections and extra mobile-history scenarios. Retained checks cover abandoned versus dispatched fork uncertainty; /fast dispatch supersession; discovery lock release after exit; stale-send draft preservation; OSC status lifetime; future-version file preservation; launch cancellation before/during dispatch on both layout owners; mobile resume addressability before hooks; and recipe snapshot cleanup after plugin removal. The paired browser-link Electron source is unchanged. Terminal launch seams, mobile roles-only history and injected provider results do not establish native terminal destruction, transcript text fidelity or real remote provider cleanup.  All prior notes and complete dated receipts retain their original scopes.",
        "Audit3451 composes ROOT-adopted3444/independent3445: intentionally removes101 authored registrations across16 reviewed sources, deleting7 whole suites and reducing8; one reviewed source is unchanged. Fresh main has123 authored registrations before and22 after because an upstream direct-child shell regression remains verbatim with zero removal credit. Registered removals are100+7*S and explicit-active removals99+7*S, where S is the unprobed count0..3 of admitted bash/zsh/fish shells. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses extra stream lifecycle/forwarding examples, unreadable-store/cache projections, orchestration presentation/benchmark cases, remote-owned routing matrices, mobile legacy navigation and model-catalog listing/cache examples. Whole suites retire renderer client-event projections, manually assembled structured-session reader ownership, mobile prompt presentation, renderer AI-vault resume commands, mobile Jira URL lookup, composer retention and mobile folder source-repository queries. Retained checks preserve original stream/store/orchestration/routing/navigation/catalog cases and shell behavior, including the upstream direct-child case. No real provider, native desktop or mobile acceptance is established by this reduction. All prior notes, assertion references and complete dated receipts retain their original historical scopes.",
        "Audit3456 composes ROOT-adopted3449/independent3450: intentionally removes62 authored/82 potential expanded cases from16 selected drivers, including7 whole suites, while13 authored/13 potential cases remain. Delete the unused48line legacy workspace-session JSON fixture with zero test credit. These are source-only reductions without equivalent replacement or fresh runtime claims. Broad unit discovery intentionally loses whole trust-dialog observer, background-turn notifications, redirected session refusal, typed-agent identity, chat-tab lifetime-cost, model-manager and mobile diff-review controller suites, plus individual persistence, synthetic composition, pairing, manifest and subprocess samples. Retain deferred snapshot dirty-domain persistence, two direct editor ownership cases, stream counter-domain distinction, two persisted pairing identity cases, parser entrypoint asymmetry, dictation retry and process-group timeout; paired restart and packaged old-binary/corrupt-profile journeys remain in their E2E driver scope. Retained checks do not replace removed alarms. No fresh execution, native IME/microphone, real authentication, mixed-version/platform or performance result is claimed. All prior notes and archived receipts retain original scopes.",
        "Audit3468 accepted source proposal AUTHOR3462/PEER3463, composed privately by audit3469: removes62 authored registrations/95 finite potential expansions, including5 whole suites, retaining25 authored registrations/29 finite potential expansions. ROOT approved source value; no equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses the profile-state worker smoke, worker-agent views and three search discovery suites, plus samples from node-server qualification, skill-bundle generation, CLI hooks/profile/recovery/offline admission, permission-hook holds and search indexing. The separate Cloud relay runner loses one relay blackbox sample; unchanged mobile native-chat and dependent-transcript drivers remain. Retained source callback/table/ancestor/fixture bytes bind to the sealed candidate. No physical-device, mixed-version, remote, cross-platform or app execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3438 composes ROOT-adopted3434/independent3436: intentionally removes60 authored/62 potential expanded cases across16 sources, deleting9 whole suites. Eight authored/eight potential cases remain; delete the102line unused ACP fixture and57line unused teardown helper with zero test credit. No equivalent replacement or fresh execution is claimed. Broad unit discovery loses ACP model-catalog fixtures, resume-record projections, dashboard mock payload/state cases, mobile folder/launch/session examples and dictionary pipeline rows. Selected E2E removals also retire auto-conversion and golden-core journeys and one Windows CLI conversion registration. Retain ACP reply text across a resumed subagent, both VAD checks, focused tab send ownership, async focus ownership in happy-dom, the question-skip journey, the original managed Windows CLI lifecycle journey and dictionary substitution. These checks do not replace the removed alarms.  All prior notes and dated/archived evidence retain original scopes.",
        "Audit3470 composes ROOT-approved AUTHOR3466/PEER3467 source proposal: intentionally removes38 authored registrations/59 finite potential expansions, including8 whole registering suites, retaining13 authored registrations/18 finite potential expansions. The sole dead shell-recipe caller cleanup has zero additional test credit. No equivalent replacement, fresh runtime or merge credit is claimed. Broad root-unit discovery loses process-import boundary, Korean/Japanese locale policy, worker-reset, mobile agent-history/queued-message and median-summary suites, plus packaged mobile-manifest, worker-pool fixture, HTML preview, mobile shell and terminal samples. The environment-provider contract and its sole shell-recipe caller are deleted. Separate cross-version-wire discovery loses the large byte-budget fresh-snapshot/replay sample while retaining independent live same-revision note publication; the retained terminal stale-refresh and dirty HTML draft persistence checks do not replace removed alarms. The source4 unused start/stop fixture hooks are removed; its retained nested failed-import test remains byte-exact with its own lifecycle. Unchanged SVG preview and Git-resolution registrations stay intact. Root balanced CI excludes the cross-version directory, which has a separate job; unbalanced root discovery can include its parent. No native app/device, actual remote, released-pair interoperability or cross-platform execution result is claimed. Earlier notes, complete dated receipts and archived gaps retain their original scopes.",
        "Audit3492 composes ROOT-approved75(AUTHOR3475/PEER3476 and AUTHOR3485/PEER3481, including five-field clarification and zero-credit selector3483) plus123(AUTHOR3486/PEER3487 reconciled FINAL3491, including peer case10:3 and9:0 wording clarifications). It intentionally removes198 authored registrations/232 finite literal-table potential registrations across70 changed JS/TS test sources, including45 whole suites;87 authored/90 finite potential registrations remain across95 reviewed JS/TS bodies. One mobile native-suspension manual recipe and the now-unreferenced GitLab mock fixture helper are separately removed with zero registration credit. Static literal table potential is not execution. No equivalent replacement, fresh runtime result or merge credit is claimed. Earlier135 complete dated receipts, all raw gaps and full prior98/161/history notes retain their exact scopes and bytes. The additional123 retirement accepts loss of mocked GitLab request/error/identity/classification inventories; basic Linear migration and metadata discovery; simulated OpenCode key failed-save retention/retry/log redaction; analytics identity-flush smoke that did not prove ordering; AppImage static entry guards and empty-staging cleanup; GPU/process/minidump breadcrumb/annotation shapes and weak redaction oracles; namespace/status/foreign-launcher ownership guards and persistence roundtrips; profile transfer field projections; worker hook/screen/incarnation/result admission/classification guards; and source-coupled CLI transaction fixtures. Privileged publication failure injection was a false-positive: its mkdir regex missed -m 700 and outer rejection accepted an inner assertion before any shell ran. The identity-flush case awaited identity after flush and could pass despite early flush. Retained actual negative-token cache recovery, SQL filter-before-LIMIT open approval, unreadable-root FTS preservation/degradation, latest-connect-wins persistence, worker stop-debt settlement, unmodified same-inode foreign-content transaction, explicit incomplete-pagination error, FTS own-message snippet association, filter-before-route result and bounded-search truncation honesty are distinct bounded outcomes, not replacements for retired alarms. Case9:0 checks both roots before chmod but only mounted-session/degraded-root after chmod. Entire extraction-root suite is removed; no retained extraction cleanup is claimed. Removing the manual iOS foreground-stall shell script loses its unique real native-suspension recipe; timer tests do not replace it. First-match PIDs, indefinite waiting, broad success matching and absent trap cleanup made that diagnostic brittle and able to leave a desktop stopped. The current Windows operational driver remains byte-exact, preserving already-merged removal of orcad-convert and orcad-cli-convert selectors and the retained cmd/powershell/managed CLI lanes. The package skill-sharing release selector loses only the exact already-retired skills-suite token; no extra test credit. Included approved75 retirement account follows (historical proposal labels identify provenance; final198 counts above control): Audit3488 composes ROOT-approved source49(AUTHOR3485/PEER3481, including its immutable five-field clarification) and source26(AUTHOR3475/PEER3476): intentionally removes75 authored registrations/87 finite potential registrations across35 changed sources, including25 whole suites;35 authored/36 finite potential registrations remain in the combined reviewed scopes. Literal table potential counts are not executions. This source-only reduction has no equivalent replacement, fresh runtime result or merge credit. Root unit discovery deliberately loses entire message-row filtering/chunk reconstruction, discussion-pagination rejection passthrough, Linear bearer/stack redaction, new-profile telemetry/default/existing-JSON no-op, WSL user-trigger routing, terminal-delivery refusal, native-chat worker-approval UI, followup-paste routing, live-surface tombstone refusal, activity-bar hydration, fabricated approval-caller policy, child-PATH transformation and branch-review URL/identity suites. It also loses cache roundtrip/mode/fingerprint/fallback/no-op samples; GPU field-shape privacy examples; older auth-probe failure retention; orphan SQLite-sidecar/future-schema admission; usage tie/duplicate/composite-key examples; allocation-name sanitizer/unknown-prefix examples; real worker-and-backup preflight wrapper smoke; and JSONL descriptor-loop truncation. The discussion page contained id-only discussions without notes, so its rejection did not prove a nonempty notes-prefix oracle. The preflight did launch actual worker/backup entrypoints with production internal self-validation; removing its revision/version wrapper deliberately retires that real-entry smoke alarm. The skipped-prefix JSONL keeper rewrites/grows after collecting the suffix and before final validation, not concurrently during parsing. Retained queue rejection/recovery and held/drain mechanisms, recorder nonsettling-provider deadline, corrupt authoritative-DB refusal, legacy cache split migration, merge-added-row indexing, external-frame redaction, and pinned JSONL read/verification/mutation checks are bounded concrete oracles, not equivalent replacements for retired alarms. The full cloud relay cohort/ceiling/control suite is separately removed from the relay package runner, outside root unit discovery; no cloud runtime result is claimed. The Python computer-use benchmark remains unchanged tooling with zero authored/removal credit; no native benchmark trial ran. The package skill-sharing release selector drops only the exact already-deleted skills-suite token, with zero additional removal credit. Prior dated receipts, raw gaps, and complete earlier161/98/history notes remain exactly at their original scopes; no changed-source historical receipt becomes fresh reduced-suite evidence. Included approved26 alarm account: Broad root-unit discovery loses entire ref-label string, hostile/malformed CSV-link rendering, Codex filename-discovery, mocked paged-preview postscan mutation, usage path-containment, real symlink-ancestor, Codex skip RPC, local/remote inference routing, width-preference, and synthetic workspace-document input suites. It also loses the hand-assembled sorted CSV edit example, connect-time JPEG seed and invalid AVCC guard samples, and eight-record/64KiB detector boundary cases. The symlink suite exercised actual kernel traversal; its lost ancestor alarm could omit supplemental local editor watches and leave content stale, not bypass authorization. Retained linked stream cancellation, preview-only save fence, failed-flush dirty-draft preservation, clipboard byte/edit preservation, fragmented AVCC parsing and independent quoted-CSV interpretation checks do not replace these deliberately retired alarms. The stream fixture uses an in-memory source and does not establish actual fd cleanup; editor save endpoints are synthetic, browser events are synthetic, and no native focus, actual remote delivery, real disk write, cross-platform execution or interoperability is claimed. Earlier complete dated receipts, raw known gaps and previous notes are historical evidence at their original source/selector scope, not fresh evidence for this reduced suite.   Earlier notes, complete dated receipts and archived gaps retain their original scopes."
      ],
      "demotionRule": "Keep experimental if any direction skips or fails; do not extend timeouts or retry to green."
    },
    {
      "id": "terminal-input.native-wayland-hangul-digit",
      "title": "Native Wayland Hangul terminating digits reach the PTY exactly once",
      "maturity": "experimental",
      "protection": "partial",
      "owner": "terminal-input",
      "layer": "electron-native-ime-e2e",
      "surfaces": ["native Hangul composition", "Wayland terminal input"],
      "platforms": ["linux"],
      "providers": ["local"],
      "coveredPlatforms": ["linux"],
      "coveredProviders": ["local"],
      "coverageNotes": "Ubuntu 22.04 nested GNOME and IBus Hangul drive three complete native executions in GitHub Actions. GNOME owns IBus; daemon and CLI share its default config discovery path.",
      "motivatingLinks": ["https://github.com/stablyai/orca/pull/19174"],
      "invariant": "Typing d k 1 Return through native IBus Hangul delivers exactly 아1 followed by newline without missing, duplicate, or reordered characters.",
      "oracle": "Three executions each assert three exact UTF-8 PTY lines. Verify the exact Playwright title, zero skips/retries, each individual native composition receipt, and the nested launch Wayland flag.",
      "commands": [
        "gh workflow run terminal-ime-e2e.yml",
        "gh run view 34074017928 --log",
        "pnpm exec playwright test --config tests/playwright.config.ts tests/e2e/terminal-hangul-terminating-digit-native.spec.ts --project=electron-headful --workers=1 --repeat-each=3 --retries=0 --reporter=list,json"
      ],
      "testFiles": ["tests/e2e/terminal-hangul-terminating-digit-native.spec.ts"],
      "assertionRefs": [
        {
          "file": "tests/e2e/terminal-hangul-terminating-digit-native.spec.ts",
          "assertions": ["a digit typed right after a Hangul syllable reaches the pty"]
        }
      ],
      "evidenceRuns": [
        {
          "date": "2026-09-07",
          "runner": "ci",
          "platform": "linux",
          "command": "gh run view 34074017928 --log",
          "result": "passed",
          "summary": "Permanent runner passed three native executions, nine exact lines and zero skips/retries. Downloaded participation report and all three engagement receipts verified; compositor cleanup reported no remaining group members. Independent X11 job passed.",
          "durationSeconds": 76.61
        }
      ],
      "runtimeBudget": {
        "p95Seconds": 1500,
        "scope": "CI job timeout including installation/build; measured p95 not established"
      },
      "flakeHistory": {
        "status": "soaking",
        "evidence": "Earlier diagnostic repetition had one unexplained missing Hangul commit. GNOME-owned diagnostic and corrected permanent runner each passed 3/3. Long-term soak is missing."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Original exact-byte assertions retained. Permanent startup failed until the GNOME config-discovery mismatch was corrected. No intentional production regression was introduced."
      },
      "performanceBudget": {
        "required": false,
        "evidence": "CI-only harness; no application runtime changes."
      },
      "promotionCriteria": [
        "Collect 100 soak runs across 14 days with no unexplained flakes.",
        "Exercise native Wayland desktops beyond nested GNOME before broadening the claim."
      ],
      "knownGaps": [
        "Only Hangul terminating digits; no native candidate-selection or other input-method coverage claim.",
        "No macOS, Windows, SSH terminal, packaged build, or mixed-version claim.",
        "Default config paths are shared with GNOME on a disposable hosted CI runner; nested mode refuses non-GitHub-Actions execution."
      ],
      "demotionRule": "Keep experimental on unexplained failures; retain exact bytes and participation checks without retries, skips, or longer deadlines."
    },
    {
      "id": "relay.control-activation-ownership",
      "title": "Closed queued controls leave persistence for the live retry",
      "maturity": "experimental",
      "protection": "none",
      "owner": "relay",
      "layer": "registry-unit-and-local-websocket",
      "surfaces": ["relay host control activation"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof. Historical scope before this audit: Actual registry queue with controlled store latency plus local WebSocket proof and connection-capacity suites on macOS. No PostgreSQL or live remote host run. PTY, daemon, SSH process state, WSL execution and folder/git workspace behavior are unaffected.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/cloud/apps/relay/src/connections/host-session-registry.ts"
      ],
      "invariant": "A closed queued transport starts no durable activation; an already-started activation retains cleanup, and a live successor becomes the indexed control without concurrent same-host activation.",
      "oracle": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  Queue a closed control before a live retry behind stalled persistence. With controlled 4s store calls, require two total activations, one release for the already-started closed control, and live readiness at 4s. Existing tests retain cleanup when closure happens during I/O.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Focused unit and local socket suites; p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Baseline regression failed: three activation calls, two releases, live ready at 8s. Guarded registry passed with two calls, one release, live ready at 4s under controlled store latency."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Deletes abandoned persistence before it starts. No new timer, polling, queue, provider call or wire change; existing FIFO and post-I/O cleanup remain."
      },
      "knownGaps": [
        "Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof.",
        "No real PostgreSQL contention benchmark or live remote host/physical mobile run.",
        "Windows/Linux execution and CI soak are not recorded; queue cleanup after a never-settling predecessor remains unchanged.",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes."
      ],
      "promotionCriteria": [
        "Retain red/green count and latency assertions; collect cross-platform and CI soak evidence."
      ],
      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without retries or weakening count, identity or cleanup assertions."
    },
    {
      "id": "relay.assignment-headroom-scope",
      "title": "Single-cell admission preserves capacity with bounded headroom reads",
      "maturity": "experimental",
      "protection": "none",
      "owner": "relay",
      "layer": "sqlite-store-integration",
      "surfaces": ["relay assignment admission", "relay migration target capacity"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["relay"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof. Historical scope before this audit: Actual assignment store and SQLite tests on macOS. No real PostgreSQL or live remote host/physical phone run. Local/daemon PTY, SSH execution ownership, WSL, folder/git workspace behavior and transport framing are unaffected. Audit1279 removes fake SQL lock-order receipts, diagnostic projections and mocked reserve callback cases from this selector. Their precise local alarms are intentionally lost; retained SQLite headroom/state checks are not claimed as equivalent replacements. The 2026-09-25 receipt is archived as historical data; the shortened selector has no fresh runtime result yet. The remaining six-file selector passed 164 cases on Linux after these removals; this fixture result is separate from the archived dated receipt and does not establish native PostgreSQL behavior. Audit1507 removes the mocked lock-counter suite from the active selector; the 2026-11-04 six-file receipt remains historical and does not validate the shortened five-file selector. Its direct mocked counter alarm is intentionally retired without replacement equivalence.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23035"],
      "invariant": "A single-cell capacity check reads only that cell while retaining snapshot freshness, incarnation, outstanding reservation and missing-limit policy; new placement retains the full fleet inventory.",
      "oracle": "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  With 32 capped cells, an existing active host stays on its pinned cell and reads one headroom row; new placement reads all 32. Missing, expired or prior-incarnation snapshots, capacity exhaustion and outstanding debt still refuse the active pinned host; an uncapped cell remains admissible.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Focused SQLite store/capacity/lock-order suites; p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local validation only; no CI soak."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Baseline two count regressions failed: sticky headroom 32 rows instead of 1 and uncapped target 31 unrelated rows instead of 0. Narrowed query passes all eight regression cases."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Actual sticky path result rows 32 to 1; no new timer, polling, queue, cache or provider call. Supplemental SQLite query benchmark with 32 cells and 400 active reservations each measured median per-query 0.285ms to 0.022ms; not a production PostgreSQL latency claim."
      },
      "knownGaps": [
        "Audit1572 removes relay predicate/threshold tables, telemetry and route/schema inventories, fake-socket forwarding and simulator-owned diagnostic paths without equivalent replacement claims. Retained production admission queues, placer/reserve-book simulations, reservation lifecycles, bounded Response streams, last-known-good flag state, poller reachability, configuration safety and ledger fences are validated with supplied clocks, network, identity, SQL and socket boundaries. No deployed cell, live Google metadata/storage, PostgreSQL, real socket handshake or authorization proof.",
        "Real PostgreSQL query plan and concurrent admission not rerun for the scoped variant.",
        "Windows/Linux execution, live remote host/mobile flows and CI soak are not recorded.",
        "Historical receipt before Audit1279 selector removal; original command, currentCommand, counts and result are preserved as data and do not validate the shortened selector: {\"date\":\"2026-09-25\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false\",\"result\":\"passed\",\"durationSeconds\":0.513,\"summary\":\"189 tests across seven files passed; independent root rerun also passed189 tests. Relay typecheck passed separately.\"}",
        "Historical receipt before Audit1507 selector removal; preserved as data, not proof of the current selector: {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay test src/assignment/assignment-headroom-scope.test.ts src/assignment/assignment-connection-headroom.test.ts src/assignment/assignment-store.test.ts src/cell-inventory-lock-contention.test.ts src/assignment/assignment-isolated-cell-replacement.test.ts src/regional-rehome-target-selection.test.ts --silent=false --maxWorkers=2\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment/assignment-store.test.ts ../../../cloud/apps/relay/src/cell/admission/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/assignment/regional-rehome/regional-rehome-target-selection.test.ts --silent=false\",\"result\":\"passed\",\"durationSeconds\":2.22,\"summary\":\"164 tests passed across the six remaining headroom fixture suites on Linux through the relay package runner, including its schema/contract build hooks. This executes the current selector with two workers. It does not establish native PostgreSQL contention or transaction recovery coverage.\"}",
        "Audit3413 composes root-adopted3405/independent3406 and3409/independent3410: intentionally removes337 authored registrations/363potential expanded cases from13sources, retaining31authored/32potential cases and deleting one whole clipboard suite, without equivalent replacement or fresh execution. Cloud relay source review intentionally retires95assignment-store examples,23real-process blackbox variants,22headroom examples,17conditionalPostgreSQL examples and25isolated-cell replacement examples. Retain3assignment-store,7blackbox,1headroom,2PostgreSQL and1isolated-cell rollback/log positive-control cases. Two PostgreSQL cases remain conditional on ORCA_RELAY_TEST_POSTGRES_URL; timing-sensitive <300ms threshold remains. These gates already have no active selectors/evidence and protection none; historical receipts remain historical.  All previous note strings, dated receipts, archived raw receipts and prior gap entries retain their original scopes."
      ],
      "promotionCriteria": [
        "Retain red/green row budget and semantic admission cases; collect PostgreSQL, cross-platform and CI soak evidence."
      ],
      "demotionRule": "Keep experimental until soak evidence; investigate admission/ownership regressions without weakening row or capacity assertions."
    },
    {
      "id": "terminal-history.tombstone-rescan-ownership",
      "title": "Shell-history cleanup reuses one directory listing while preserving deletion ownership",
      "maturity": "experimental",
      "protection": "none",
      "owner": "desktop-runtime",
      "layer": "main-filesystem-contract",
      "surfaces": ["shell-history tombstone cleanup", "native and WSL history deletion"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1400 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: Actual macOS temp-filesystem deletion and fake WSL cleanup ownership. Live Windows, Linux and WSL execution untested; SSH and daemon replay unaffected because every path here is host-local. Audit1400: src/main/pty/history/terminal-history-gc-fs-call-count.test.ts reduced. Lose filesystem-call budgets and oracle-equivalence alarm; independently expected removal and preservation remain. No equivalent replacement coverage is claimed.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23030"],
      "invariant": "Only renamed tombstones are recursively removed, active plus retry admissions stay at 64, retries retain their delays and exhaustion behavior, a root displaced at the cap is admitted from another root's freed slot, and no tombstone is handed to removal twice per listing.",
      "oracle": "No current automated execution oracle is claimed for this gate after Audit1400 retired changed-source receipts. Historical oracle account: Drain 1,024 real directory entries in controlled batches using at most 8 directory listings and 64 active removals. Exercise late arrivals discovered after the listing, both roots draining under one shared cap, a failing listing mid-drain, delayed failure retries, exhausted attempt budgets, and cancellation of an in-flight listing.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "Audit1400 retired changed-source receipts; reduced selector has no new soak result. Historical account: Local author and independent runs pass; CI/soak history not collected."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit1400 changed referenced test sources; no new red/green validation. Historical account: Pre-change main lists the tombstone directory 1,026 times for 1,024 tombstones and fails the bounded-listing oracle. Reusing one listing reduces it to 6 while still removing every entry."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Historical budget only after Audit1400 changed test sources; no new measurement. Previous account: Five real-filesystem samples per version, 1,024 tombstone directories each holding a meta.json, macOS arm64 / Node 24, identical harness. Median directory listings 1,026 to 6, names enumerated 494,348 to 1,077, blocking main-thread time in the rescan path 820 to 7 ms (the listings themselves 266 to 2.7 ms, and now off-thread), total drain 886 to 75 ms. The remaining ~70 ms is the recursive rm itself and is unchanged. Average concurrent removals 62 of 64, restored from the 46 an event-loop-deferred refill left idle. No polling, no new timers, and no work deferred past process exit."
      },
      "promotionCriteria": [
        "Collect 100 consecutive CI passes or 14 days of soak history.",
        "Run native Windows and WSL history cleanup on real filesystems."
      ],
      "knownGaps": [
        "No rendered UI latency measurement or physical Windows/Linux/WSL run.",
        "One listing is retained per root while it drains, about 160 KB per 1,024 tombstones, shrinking as names are consumed.",
        "A small backlog still costs roughly one listing per completion batch, of a directory that is nearly empty by then.",
        "A tombstone that exhausts its retries stays on disk until the next startup, unchanged from before.",
        "Audit1400: src/main/pty/history/terminal-history-gc-fs-call-count.test.ts reduced. Lose filesystem-call budgets and oracle-equivalence alarm; independently expected removal and preservation remain. No equivalent replacement coverage is claimed.",
        "Audit1400 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n          \"date\": \"2026-09-26\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/terminal-history-tombstone-scan-cost.test.ts src/main/terminal-history-async-delete.test.ts src/main/terminal-history-tombstone-retry.test.ts src/main/terminal-history-gc-fs-call-count.test.ts src/main/terminal-history-gc.test.ts src/main/terminal-history.test.ts\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/pty/history/terminal-history-tombstone-scan-cost.test.ts src/main/pty/history/terminal-history-async-delete.test.ts src/main/pty/history/terminal-history-tombstone-retry.test.ts src/main/pty/history/terminal-history-gc-fs-call-count.test.ts src/main/pty/history/terminal-history-gc.test.ts src/main/pty/history/terminal-history.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.95,\n          \"summary\": \"86 tests across six suites passed, repeated three times with no flakes.\"\n        }",
        "Audit1400 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"wsl\"]}. Remaining provider scope applies only to unchanged-source receipts.",
        "Audit1400 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n  {\n    \"file\": \"src/main/pty/history/terminal-history-tombstone-scan-cost.test.ts\",\n    \"assertions\": [\n      \"drains 1024 tombstones without re-reading the directory per completion\",\n      \"picks up a tombstone created after the queued names were read\",\n      \"drains both roots within the shared admission cap without per-completion reads\",\n      \"keeps draining after a directory read fails mid-drain\",\n      \"drops an in-flight refill during fixture cleanup\",\n      \"preserves delayed failure retries while successful removals replenish the queue\",\n      \"does not retry a tombstone past its attempt budget when another root frees slots\"\n    ]\n  }\n]",
        "Audit1400 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n        {\n          \"file\": \"src/main/pty/history/terminal-history-tombstone-scan-cost.test.ts\",\n          \"assertions\": [\n            \"drains 1024 tombstones without re-reading the directory per completion\",\n            \"picks up a tombstone created after the queued names were read\",\n            \"drains both roots within the shared admission cap without per-completion reads\",\n            \"keeps draining after a directory read fails mid-drain\",\n            \"drops an in-flight refill during fixture cleanup\",\n            \"preserves delayed failure retries while successful removals replenish the queue\",\n            \"does not retry a tombstone past its attempt budget when another root frees slots\"\n          ]\n        }\n      ]",
        "Audit1400 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/pty/history/terminal-history-tombstone-scan-cost.test.ts src/main/pty/history/terminal-history-async-delete.test.ts src/main/pty/history/terminal-history-tombstone-retry.test.ts src/main/pty/history/terminal-history-gc-fs-call-count.test.ts src/main/pty/history/terminal-history-gc.test.ts src/main/pty/history/terminal-history.test.ts\"],\"testFiles\":[\"src/main/pty/history/terminal-history-tombstone-scan-cost.test.ts\",\"src/main/pty/history/terminal-history-async-delete.test.ts\",\"src/main/pty/history/terminal-history-tombstone-retry.test.ts\",\"src/main/pty/history/terminal-history-gc-fs-call-count.test.ts\",\"src/main/pty/history/terminal-history-gc.test.ts\",\"src/main/pty/history/terminal-history.test.ts\"]}"
      ],
      "demotionRule": "Keep experimental or demote if the reused listing strands a displaced root, crosses the admission cap, rearms an exhausted retry through another root, hands one tombstone to removal twice, or touches a recreated live history path."
    },
    {
      "id": "terminal-performance.consumed-side-effect-retention",
      "title": "Terminal side-effect queues release successfully applied and evicted effects",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "renderer-unit",
      "surfaces": ["terminal output side effects", "renderer memory census"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts: keeps empty-tail coalescing observable during the apply callback; preserves thrown apply errors and their existing empty-tail coalescing. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Provider-independent queue and mocked IPC output contracts run on macOS. Remote-runtime uses this processor but has no live session run. Native mobile uses another processor and is unaffected; host ownership, ACKs, wire, paths, folder/git identity, PTY lifecycle and output bytes are unchanged. Linux, Windows, WSL and live remote execution are gaps.",
      "motivatingLinks": [
        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/terminal-pane/pty-output-side-effect-queue.ts"
      ],
      "invariant": "Release consumed title/payload objects after successful apply or overflow carry, preserving callback order, 64-effect drains, the 512-effect pending cap, bell and payload carry, empty-tail coalescing, reentrant clear/flush/enqueue, thrown-apply behavior and output delivery.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts: keeps empty-tail coalescing observable during the apply callback; preserves thrown apply errors and their existing empty-tail coalescing. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts remains historical and is not a passing result for the reduced current command. Historical prior account (preserved verbatim): Forced GC collects all 64 applied effects from a 100-effect bounded drain while the remaining 36 stay alive and deliver in order; it also collects the first evicted effect in a 513-effect burst while all 512 survivors remain alive. Clearing during apply immediately releases all 99 other pending effects, as the original queue did. Census reports 36 retained objects after the bounded drain. Explicit reentrant and error cases produce the same observations against the original queue.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Focused renderer queue/output tests, including forced GC; p95 not established."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local author and independent review validation; no CI soak. Reference-lifetime tests require the test runner's existing --expose-gc."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Historical prior account (preserved verbatim): Original queue fails both WeakRef collection assertions: all 64 applied effects and the evicted effect remain reachable. Clearing only consumed slots passes while all pending effects stay live. Baseline and candidate both pass all four reentrant/error observations."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Retained objects fall from 100 to 36 after one bounded drain and from 513 to 512 after one overflow eviction before compaction. Release is constant work per consumed effect; no changed drain limit, timer, polling, batching, cache, transport call or subprocess. Existing compaction cadence remains; clear truncates then replaces its backing array to preserve immediate release and protect reentrant same-object requeue."
      },
      "knownGaps": [
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts: sums registered gauges and drops disposed ones; ignores a repeated dispose instead of dropping another gauge; stops tracking new gauges past the cap so a missed dispose cannot grow it; tracks a live output processor queue through enqueue, drain, and dispose; excludes cleared consumed entries from retention after a bounded drain. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts. Unresolved local/computed edges remain explicit debt. Complete dated receipts with direct selectors or current literal graph reaching src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts are retired below as historical raw objects; their counts do not validate reduced commands. All 1 affected passing receipts are retired, so protection becomes none pending a fresh run. Original current selectors and assertion inventory, preserved as historical data only: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-retention.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-output-side-effects.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-eager-buffer-replay.test.ts\"],\"testFiles\":[\"src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-retention.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-output-side-effects.test.ts\",\"src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-eager-buffer-replay.test.ts\"],\"assertionRefs\":[{\"file\":\"src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-retention.test.ts\",\"assertions\":[\"releases applied effects while preserving every pending effect and its delivery order\",\"releases an evicted effect before the compaction threshold\",\"releases every pending effect immediately when clear is called during apply\"]},{\"file\":\"src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts\",\"assertions\":[\"keeps empty-tail coalescing observable during the apply callback\",\"delivers the same effect requeued after clear without releasing its new slot\",\"preserves nested flush order and effects enqueued after the inner compaction\",\"preserves thrown apply errors and their existing empty-tail coalescing\"]}],\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\"]}. No claim that retained test bodies disappeared. Historical retired receipt verbatim:\n{\n          \"date\": \"2026-10-01\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/pty-output-side-effect-queue-retention.test.ts src/renderer/src/components/terminal-pane/pty-output-side-effect-queue-reentrancy.test.ts src/renderer/src/components/terminal-pane/pty-side-effect-pending-census.test.ts src/renderer/src/components/terminal-pane/pty-transport-output-side-effects.test.ts src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.66,\n          \"summary\": \"46 tests across five files passed. Four reentrant/error cases also pass against an isolated original-queue copy; stock and candidate both release 99 pending effects when clear runs during apply.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-retention.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts src/renderer/src/components/terminal-pane/pty-transport/output/pty-side-effect-pending-census.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-output-side-effects.test.ts src/renderer/src/components/terminal-pane/pty-transport/ipc/pty-transport-eager-buffer-replay.test.ts\"\n        }",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts: keeps empty-tail coalescing observable during the apply callback; preserves thrown apply errors and their existing empty-tail coalescing. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence. The historical receipt/currentCommand selecting src/renderer/src/components/terminal-pane/pty-transport/output/pty-output-side-effect-queue-reentrancy.test.ts remains historical and is not a passing result for the reduced current command.",
        "No real renderer heap-byte or input-latency measurement; references and complete delivery are the deterministic oracle.",
        "No live Linux, Windows, WSL, SSH or paired-runtime session run; these use provider-independent queue code.",
        "Thrown apply callbacks keep their consumed reference until the original compaction boundary to preserve exception/coalescing behavior."
      ],
      "promotionCriteria": [
        "Collect CI soak with zero unexplained GC flakes and retain callback-order, overflow-carry and reentrancy assertions."
      ],
      "demotionRule": "Keep experimental; investigate delivery, coalescing, error-path or pending-reference regressions without weakening the retention or fidelity oracle."
    },
    {
      "id": "orchestration.worker-recovery-convergence",
      "title": "Settled assignments leave recovery while unresolved workers retain automatic recovery",
      "maturity": "experimental",
      "protection": "none",
      "owner": "orchestration",
      "layer": "sqlite-runtime-provider-contract",
      "surfaces": [
        "worker and assignment settlement",
        "historical worker repair",
        "deleted git and folder workspaces",
        "recovery retry scheduling",
        "durable session retirement"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. NEXT136 retired affected callbacks and complete execution receipts. No equivalent fresh execution, provider/platform scope, soak or measured-budget credit is claimed.",
      "motivatingLinks": [
        "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1791225819076759",
        "https://github.com/stablyai/orca/pull/11271",
        "https://github.com/stablyai/orca/pull/22612"
      ],
      "invariant": "Completing an assignment settles its active worker bookkeeping in the same transaction without asserting process exit or releasing a terminal. Historical settled assignments converge on database open; an additive active-worker index excludes finished history, and healthy checks do not take a writer lock. Missing workspaces require owning-provider evidence before exact-incarnation retirement; a restarted relay's empty inventory and loss of contact are unverifiable. Automatic retries retain unresolved assignments without revisiting settled workers or persisting empty batches; late availability converges without user intervention.",
      "oracle": "Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2095 current-parent preparation2126: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Audit2090 (sources2088/2089): Current reduced suites intentionally retire the alarms listed in knownGaps; prior dated execution and replacement claims do not validate changed source bytes or selectors. No current executed oracle remains after the authorized source-case and receipt retirements.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Historical measurement only for changed selectors; no new reduced-source runtime budget is measured."
      },
      "flakeHistory": {
        "status": "unknown",
        "evidence": "NEXT136 retired affected callbacks or receipts. No fresh soak result validates reduced sources; retained receipts apply only to their unchanged commands."
      },
      "redGreenEvidence": {
        "status": "missing",
        "evidence": "Audit2133 current-parent preparation: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. Audit2095 current-parent preparation2126: Changed test bytes/selectors have no fresh red/green validation. Unrelated retained-source historical evidence keeps its original scope. NEXT136 retired affected callback/receipt scope. No fresh red/green validation of the reduced selectors is claimed."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "No fresh changed-source performance measurement is claimed. Unchanged retained receipts keep only their original scope."
      },
      "knownGaps": [
        "Audit2086 (sources2082/2083): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-06.spec.ts: suppresses saved mobile agent status when live evidence is the Claude agents screen; suppresses saved mobile agent status when the current terminal title is neutral; suppresses saved mobile agent status when fresh live OSC title is Claude agents; keeps saved PTY bindings pending until the runtime knows the PTY is connected; refreshes daemon PTY liveness before publishing mobile session tabs; does not invalidate a newly spawned SSH pane from an overlapping stale process list. src/main/runtime/orca-runtime-tests/pty-title-status.spec.ts: associates controller PTYs with mixed-case Windows and UNC cwd paths; uses OSC titles rather than controller process names for rendererless PTYs; ignores the bare cursor-agent native title so synthesized spinner state survives; only records the bare Cursor native title via the stale-working clear; refuses a bare Cursor title while the foreground read is unavailable; does not treat a bare Cursor title as an agent once the shell owns the foreground; accepts a bare Cursor title when the foreground read confirms cursor-agent; refuses a bare Cursor title on a runtime pty with no controller attached; clears a stale working title after 3s of title-less output; cancels the stale-title timer when the PTY exits; keeps stale-title timers isolated per PTY. src/main/runtime/orca-runtime-tests/paired-settings.spec.ts: projects runtime-backed settings to paired clients; updates quick commands without widening general paired settings payloads; applies native-chat option deltas atomically on the runtime host; keeps a future-launch default when an older client asks to prune from inventory; preserves concurrent additions after forty quick commands; accepts runtime-backed setting updates from paired clients; broadcasts visibility default changes to paired clients; reconciles hooks only when paired-client hook settings change; rejects relative paths for runtime nested repo scan/import. src/main/runtime/stale-title-completion-recovery.spec.ts: bounds semantic ingestion and snapshot tab visits at %i tabs. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2076 (sources2073/2074): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/terminal-handles-part-02.spec.ts: recovers a moved SSH pane through the tab it now sits in, not the one its lease froze; reports a plain expired orphan; does not report a pane whose only recent lease was superseded; does not report a pane whose only recent lease had its relay id recycled; picks the eligible orphan over a superseded predecessor that matches first; collects the same tabs the per-tab reader reports, in one sweep of the leases; reports no candidate when no lease names any of the worktree tabs. src/main/runtime/orca-runtime-tests/runtime-availability.spec.ts: starts unavailable with no authoritative window; reports the configured Windows terminal shell on status; reports floating workspace availability from settings on status; polls floating tabs with targeted PTY liveness and no repo/provider inventory; hydrates persisted tabs when the store cannot report repos; advertises browser screencast only when a renderer window is available; routes mobile Codex reset consumption through the account mutation coordinator; maps a definite pre-provider rejection into an authoritative current snapshot. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2070 (sources2068/2069): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/hooks-and-hosted-review.spec'). src/main/runtime/orca-runtime-tests/worktree-removal-archive-hook-gate.spec.ts: removes and records the waiver when the failure is explicitly overridden; removes without an override record when the hook succeeds; removes when the hook is configured but not requested; removes when no archive hook is configured; holds a desktop removal in the same repo until this one is accepted; joins a desktop removal of the same worktree accepted while this one waited. src/main/runtime/orca-runtime-tests/worktree-ps-agent-row-dismissal.spec.ts: drops the row as soon as the user dismisses it, without waiting for the PTY to exit; tells paired clients to republish on the transition and on the dismissal; rejoins a row through its %s handle after pane ownership clears. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review.spec.ts: reports an error when the SSH filesystem provider is unavailable; reports an SSH orca.yaml as an error without reading any filesystem; reports ok for a local repo hook check; reads SSH issue commands as absent and drops writes without touching any filesystem; allows host integration slug helpers for SSH repos through provider-aware GitHub clients; routes runtime GitHub repo identity helpers through the selected WSL project runtime; routes runtime GitHub issue and work-item actions through the selected WSL project runtime; pins explicit origin preference on runtime open-by-number work item lookups; forwards check-details cancellation without local Git overrides. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2065 (sources2063/2064): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/program-status-osc.spec.ts: retire six private facet/lifecycle-state and hook-order assertions; retained public OSC/wait cases do not replace those alarms. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Native Linux/Windows desktop and WSL worker journeys, active-worker SSH absence/deleted-folder recovery, and stranded old-relay process discovery remain untested locally.",
        "No latency claim against the original customer profile; deterministic counts and one synthetic scale measurement cover the identified work.",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-10-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts tests/e2e/cross-version-wire/orchestration-delivery-downgrade.unit.test.ts\",\"result\":\"passed\",\"durationSeconds\":27.41,\"summary\":\"2,587 tests passed across 151 files; seven tests and one file skipped. Includes all 45 state combinations, rollback, historical upgrade migrations, SQL downgrade compatibility, active-worker index query plans, old-writer reintroduction, and read-only repair with a competing writer. The 50 focused tests passed separately. Reverting the index and read-only preflight produces two failures.\"}",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-10-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts tests/e2e/cross-version-wire/orchestration-delivery-downgrade.unit.test.ts\",\"result\":\"passed\",\"durationSeconds\":21.07,\"summary\":\"48 focused tests passed after worker-first startup lookups and per-pass workspace deduplication. Reverting both optimizations produces four failures. The broader lifecycle command also passed 2,585 tests across 151 files in 21.07s, with seven tests and one file skipped.\"}",
        "Retired during audit1312 selector cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-10-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts tests/e2e/cross-version-wire/orchestration-delivery-downgrade.unit.test.ts\",\"result\":\"passed\",\"durationSeconds\":56.25,\"summary\":\"2,581 tests passed across 150 files; seven tests and one file skipped. Includes SQLite lifecycle, runtime recovery, federation, CLI and SQL downgrade contracts.\"}",
        "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.",
        "Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"recovery starts zero foreground-process probes while an explicit status refresh still reads its requested terminal\"]}]",
        "Audit1412: src/main/runtime/orchestration/crew/crew-runtime-cost.test.ts removed. Loses name/status/traffic propagation, pending-question preview and post-unsubscribe quiescence alarms along with internal clone, SQL and snapshot-read budgets. No replacement-equivalence claim. src/main/runtime/orchestration-mailbox-cold-park-idle.spec.ts removed. Loses fresh-output cold-park quiet continuation, same-incarnation deferred Enter, late pointer-write settlement and explicit-check batch-claim alarms, including durable delivered_at state checks mixed into registrations0/3. No equivalent coverage claim. src/main/runtime/orchestration-mailbox-delivery-recheck.test.ts removed. Loses draft/caret/readiness/foreground/quiet retry and final-frame delivery timing alarms. Real database and emulator use do not establish actual PTY acknowledgement, and no equivalent replacement is claimed. src/main/runtime/orchestration-dispatch-mailbox-delivery.spec.ts reduced. Loses dispatch wake dedup, restart unread guidance, legacy ack behavior and ambiguous pointer write/Enter crash retention alarms. DB-only stable delivery identity does not replace those paths. src/main/runtime/orchestration/crew/crew-federation-invalidation.test.ts removed. Loses meaningful relayed question publication/completion clearing, plus no-work federation metadata/heartbeat invalidation and exact SQL/read/acquisition/publication budgets. No equivalent replacement is claimed. src/main/runtime/orchestration-mailbox-delivery.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.",
        "Audit1943 (sources1934/1935/1938): Pruned settlement suite removes exact backlog probe count and requested-assignment indexed SQL-shape alarms. Retain actual transaction rollback, durable reopen, report outcome and failed-read recovery callbacks. Retire the indexed-lookup alias and complete dated combined47-case receipt without narrowing its selector, count or result; unaffected Electron and separate repair-safety receipts retain their independent unchanged scopes. SQLite/fault seams do not establish physical worker/provider exit. Preserve meaningful remaining selectors/assertions and unchanged dated receipts within their original scope. Reduced selectors have no fresh gate execution evidence in this metadata packet. No equivalent replacement, physical watcher/PTY/provider, live SSH/remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed. Exact retired authored alarms: 'bounds the release backlog probe without truncating actual release reconciliation'; 'reads only requested recovery assignments through indexed lookups and one SQL shape'.",
        "Audit1943 historical original assertionRefs object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration/db/dispatch-context/worker-dispatch-settlement.test.ts\",\n          \"assertions\": [\n            \"repairs historical settled PTY, structured and handle-less assignments on reopen\",\n            \"preserves genuine report outcomes and pending unknown workers\",\n            \"rolls back all assignments when worker settlement fails\",\n            \"reads only requested recovery assignments through indexed lookups and one SQL shape\",\n            \"a failed SQL read remains a retry failure and recovery resumes after reopen\"\n          ]\n        }",
        "Audit1943 historical original evidenceRuns object, preserved verbatim; retired objects are not active evidence or replacement coverage:\n{\n          \"date\": \"2026-10-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/worker-dispatch-settlement.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/orchestration/worker-dispatch-repair-safety.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 1.58,\n          \"summary\": \"47 focused settlement, automatic retry, indexed SQL, missing-workspace, durable host-routing and historical-repair safety regressions passed. Includes all 45 state combinations and 100,000 historical assignments.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/db/dispatch-context/worker-dispatch-settlement.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/orchestration/terminal-authority/release/worker-dispatch-repair-safety.test.ts\"\n        }",
        "Audit1959 (sources 1955:2): Remove the diagnostic 100,000-assignment benchmark and its SQL-plan/scale aliases. Keep the actual 45-state durable reopen/idempotence, rollback, competing writer and older-writer reintroduction callbacks, within their modeled SQLite scope. The complete dated 2.29s safety/scale receipt is retired; earlier combined receipt objects already archived remain historical and byte-exact. No historical passed receipt is narrowed or transferred to changed source bytes. No fresh execution, equivalent replacement, physical provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result is claimed by this metadata packet.",
        "Audit1959 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/orchestration/terminal-authority/release/worker-dispatch-repair-safety.test.ts\",\n          \"assertions\": [\n            \"all 45 assignment and worker state combinations preserve genuine outcomes, pending work and terminal ownership\",\n            \"historical repair uses an active-worker partial index and primary-key assignment lookups without scanning settled history\",\n            \"second repair failure rolls back the first repair and leaves no partial state\",\n            \"healthy repair remains read-only while another connection holds the writer lock\",\n            \"an older SQL writer can reintroduce stale bookkeeping after repair and the next open still settles it\",\n            \"second open and repair perform zero worker mutations with 100,000 historical assignments\"\n          ]\n        }",
        "Audit1959 historical original evidenceRuns object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"date\": \"2026-10-05\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/worker-dispatch-repair-safety.test.ts\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 2.29,\n          \"summary\": \"Three safety and scale tests pass. One local run with 100,000 assignments and 1,000 stale workers: repair 38.83ms, no-op repair 25.07ms, complete subsequent database open 38.52ms. These are observations, not a CI latency bound.\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/terminal-authority/release/worker-dispatch-repair-safety.test.ts\"\n        }",
        "Audit1973: Remove lower-level scalar lifecycle examples while retaining durable completion/restart/replay and the independent Electron recovery receipt. Existing broad prospective command remains prospective only. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result.",
        "Audit1991: Remove one-inventory/100-candidate and per-pass workspace lookup-count aliases, foreign-provider timer-call counts, and the ten-minute settled-worker/empty-batch budget sample. Narrow broad inventory/incarnation/probe aliases to retained missing-membership, restarted-relay uncertainty and explicit owning-host absence-verdict callbacks. Remove rollback clone/snapshot-call budgets and supplied persistence microvariants; retain the held-write failure rollback callback that preserves concurrent in-place edits at an injected writer seam, without claiming actual disk durability. Retain late provider recovery and host timer cancellation callbacks. Preserve the independent six-journey Electron restart receipt exactly; its result does not validate these reduced runtime selectors. Historical performance and red/green observations remain historical rather than fresh measurements. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed.",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts\",\n          \"assertions\": [\n            \"late provider availability recovers automatically after two minutes\",\n            \"ten minutes of unresolved retries never revisit settled workers or persist empty batches\",\n            \"every host timer remains cancellable during extended recovery\"\n          ]\n        }",
        "Audit1991 historical original assertionRefs object, preserved verbatim; retired objects are not active execution evidence or replacement coverage:\n{\n          \"file\": \"src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts\",\n          \"assertions\": [\n            \"100 deleted git or folder workspace candidates use one owning-provider inventory\",\n            \"100 workers sharing a workspace resolve it once per pass; the next pass rechecks both git and folder workspaces\",\n            \"live PTYs without scoped membership or verified incarnation remain deferred\",\n            \"local inventory and restarted relay inventory never prove SSH worker exit\",\n            \"SSH cleanup requires an explicit owning-host absence verdict; probe failures preserve uncertainty\",\n            \"foreign provider identities do not start local recovery timers\"\n          ]\n        }",
        "Audit2052 (source2049): The ordinary orca-runtime.test.ts registrar drops seven imports of deliberately deleted low-value runtime suites. Their mock capability/agent-presence/environment/title/deduplication and batching alarms are intentionally lost without replacement; remaining imports retain their original order. The runtime handle-contract registrar separately drops the deleted tab-collision registration. Unrelated dated evidenceRuns remain unchanged and do not validate reduced-source bytes or selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2056 (sources2054/2055): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec'). src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-03.spec.ts: arms the stale-title timer for a seeded working title; arms the Command Code scrape from the noted spawn command; prefers the tracked title over a stale renderer lastTitle in the hydration seed; writes recent output into the current runtime output map; uses a later title handler replacement with the runtime receiver; calls the current injected listener with the runtime receiver; keeps optional reconciliation lazy after its callback is removed. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-14.spec.ts: lists them, so a paired client can mirror a migrated editor; closes one by retiring it from the host session; keeps an unsaved draft unless the close is forced; shares aggregate work but leaves a replacement pending promise alone; lets a targeted refresh finish while an aggregate refresh waits; refuses a close when the store lacks %s before the guard; keeps a later missing %s on the original caught failure path. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Audit2061 (sources2059/2060): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime.test.ts: ordinary registration cleanup removes only await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec'); await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec'); await import('./orca-runtime-tests/worktree-removal-execution-host.spec'); await import('./orca-runtime-tests/terminal-spawn-dispatch.spec'). src/main/runtime/orca-runtime-tests/headless-snapshots-part-02.spec.ts: replaces a cwd parsed before late WSL context with the provider cwd; keeps a live WSL cwd that arrives during late-context snapshot recovery; infers local reconstructed WSL context from a WSL UNC worktree; clears stale terminal file URI hostnames after empty-host OSC7 cwd updates; serializes SSH headless OSC7 cwd as POSIX when the desktop runtime is on Windows; keeps Windows SSH OSC7 cwd as a drive path when the desktop runtime is POSIX; serializes Windows SSH headless OSC7 cwd as a drive path on POSIX desktops; infers restored SSH connection identity from app-scoped PTY ids. src/main/runtime/orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec.ts: survives the rebuild that closing a saved editor tab forces; keeps its place in the tab order when the host lists the workspace again; lists tabs to phones in the order desktop clients draw after a rebuild; keeps the place a window gave a chat across a graph resend before the chat is restored. src/main/runtime/orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec.ts: lists every persisted terminal of a windowless host after a cold restart; lists every persisted terminal in the all-worktrees inventory after a cold restart; lists persisted editor tabs beside the terminals after a cold restart; restores a persisted split group layout on the cold rebuild; restores the saved active group of a split even when it is not the first group; falls back to the active tab group when the saved active group was not restored; keeps the headless group active when there is no persisted split; keeps phone and CLI creates in the group they joined across a cold restart. src/main/runtime/orca-runtime-tests/worktree-removal-failed-retry.spec.ts: lists the leftover with its error, though Git no longer does; takes the normal delete once Git registers a checkout at the path again; joins a retry another client started while this Delete listed Git; shows the failed row with its error, not the scan cached before the delete. src/main/runtime/orca-runtime-tests/worktree-removal-execution-host.spec.ts: refuses an SSH row whose host is unreachable instead of deleting here; refuses a runtime row with no nested SSH target rather than deleting locally; refuses a runtime row that also names a nested SSH target; retains runtime purge dispatch in a recovery job; uses the runtime helper override before resuming an interrupted removal; uses the runtime helper override before retrying a failed removal; captures the watcher callback and retains its job-host receiver; reads the current runtime removal queue. src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts: reports the spawn request before it leaves for the pty controller; reports it even when the spawn itself then fails; does not report it when the create fails before any spawn request; captures the admission method before reading the incarnation; captures the record method before evaluating its state object; skips database payload serialization when no database exists; skips a throwing database payload when no database exists; keeps the database method and receiver captured before its payload; captures the canonical map method before a binding getter changes it; completes the captured replacement fence without another map lookup. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed.",
        "Module layout policy correction: retire the remaining program-status-osc.spec.ts event-projection case (production/mock-derived pane-key oracle) and sign-in timeout case (real setTimeout wait with Date-only fake clocks). The runtime test registrar no longer imports that file. No replacement coverage or fresh execution is claimed for these losses; historical receipts retain their original source scope.",
        "Module layout policy correction: retire the two remaining worktree-ps-agent-row-dismissal.spec.ts registrations. The remint/dismissal/exit case computed expected snapshotVersion increments from a production snapshot and used real-clock vi.waitFor; the legacy OSC case derived its expected paneKey from the production layout-owner switch. The runtime registrar no longer imports this file. These public projection scenarios have no replacement coverage or fresh execution claimed; all historical receipts and earlier loss notes retain their original source scope.",
        "NEXT136: affected complete receipts are archived locally; reduced selectors and retained callbacks require fresh execution before broader coverage claims.",
        "Audit2090 (sources2088/2089): Intentionally retire these low-value alarms without replacement: src/main/runtime/orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec.ts: keeps the recorded permission flags of the launch it resumes; still refuses a session another pane also records; resumes in the pane with a window present too: main is the one executor; keeps the original provider and current retry intent through a refused main start; resumes once; a second open after it finished attaches to the same terminal; a reloaded window's open attaches to the terminal main started, never a second resume. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts: defers live workers without exact controller identity evidence; defers an SSH folder legacy worker while its folder path is unavailable. Existing unrelated evidenceRuns retain their original scope; unchanged dated receipt objects do not validate changed source bytes or reduced selectors. No fresh gate execution or historical import-closure equivalence is claimed. Frozen current literal-import graph reaches these changed test bytes; unresolved local and computed edges remain debt, and current reachability is not historical execution or equivalent replacement evidence.",
        "Audit2095 current-parent preparation2126 (approved2092/2093 removals; source refresh2109/independent2112): Intentionally retire these low-value alarms without replacement: src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts: stops paged routing when the check is cancelled; keeps an unfiltered redrive unrestricted when reservations merge; keeps an unfiltered parked delivery unrestricted when reservations merge; uses a bounded indexed pane lookup for reminted Dispatch identity. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts: rejects exact terminal stop for multiple expected PTYs before stopping anything; omits stale renderer leaves when fresh PTY liveness is required; omits unbound renderer placeholders when fresh PTY liveness is required; captures the event method before the nested sleep receipt changes it; returns the close receipt without requiring a PTY stop; uses the same stop result as an empty explicit stop. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts: builds a compact worktree summary from persisted and live runtime state; reads the linked-PR state from the renderer repoId-keyed GitHub cache; carries persisted worktree host ownership in mobile summaries; emits only instance- and boundary-validated lineage parents in mobile summaries; resolves WSL platforms only for repos represented in mobile summaries; omits worktrees hidden by the host visibility policy from mobile summaries; applies linked-checkout source visibility to mobile summaries. src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts: routes runtime GitHub PR details and actions through the selected WSL project runtime; passes SSH connection context through hosted review creation flows; routes local WSL project hosted review flows through runtime git options; treats SSH worktree drift as unknown without local git probes. src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts: emits one mobile session terminal tab per live PTY even if two tabs resolve to it; resolves projected split authority from the parent layout PTY binding; keeps explicit-id terminal lists from resolving all worktrees; keeps explicit-id cold-cache terminal lists from classifying unrelated same-repo worktrees; keeps unknown bare terminal-list ids on the no-scan exact-id path; matches explicit-id cwd PTYs for folder workspace instance IDs; routes PTY output through the PTY leaf index in large terminal graphs. src/main/runtime/orca-runtime-tests/window-authority.spec.ts: claims the first window as authoritative and ignores later windows; transfers authority from the headless sentinel to the first real window; relays terminal browser launches only while headless owns the graph; marks live headless PTYs for renderer reattach before desktop promotion; reports the activation gate state while no desktop window is available; bumps the epoch and enters reloading when the authoritative window reloads; can mark the graph ready for the authoritative window; drops back to unavailable and clears authority when the window disappears; hands the graph back to headless when a promoted serve window closes (#27292); keeps a crashed promoted serve renderer on its own window while the window is open; stays unavailable during initial loads before a graph is published. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-04.spec.ts, src/main/runtime/orca-runtime-tests/hooks-and-hosted-review-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-listing.spec.ts, src/main/runtime/orca-runtime-tests/window-authority.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-routing-races.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2133 current-parent preparation (988 authored removals; independently reviewed2099/2107/2115/2116 decisions; upstream clear-buffer and recovery-image regressions retained): Intentionally retire these low-value alarms without replacement: src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts: uses bounded ownership lookup for direct arrivals while the agent cannot take input; wakes a bound Run waiter when same-Run direct mail arrives; keeps an unowned detached-recipient message in its direct mailbox; uses primary-key lookups for bounded routing updates. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts: renders the %s CLI command in a mailbox pointer. src/main/runtime/construction/orca-runtime.test.ts: remove only literal registration import/call pairs await import('../orca-runtime-tests/worktree-setup-and-startup.spec'), await import('../orca-runtime-tests/gitlab-and-pr-bases.spec'); no additional authored credit. src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts: remove only literal registration import/call pairs import './orchestration-mailbox-pointer-cli-command.spec'; no additional authored credit. src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts: routes tab switch and capture start by explicit page id; accepts focus on tab switch without altering bridge args (focus is main-side concern); keeps terminal cwd resolution fail-soft when the provider is unavailable. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts: drops the bounded scan cache when orphan-cleanup removal completes; clears optimistic reconcile tokens when a CLI worktree removal succeeds; emits drift without mutating when the fetched base fast-forwards created HEAD; emits base_changed without mutation when the fetched base rewrote history; skips stale-token reconciles without mutating or emitting stale status; emits unknown without mutation when fetch fails or the base ref is missing. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts: routes runtime preserved-branch force-delete through the selected WSL project runtime; replies to a waiting client with the error of a delete that fails after acceptance; treats forced runtime deletion of an already-missing unregistered worktree as cleanup; treats normal runtime deletion of an already-missing unregistered worktree as cleanup. src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts: warns that a missing-repo removal only forgot the workspace; restores runtime watchers when CLI worktree deletion fails after teardown; does not re-spend the drain budget on a removal after a wedged install was abandoned; routes runtime worktree removal through the selected WSL project runtime; force-deletes a branch that was preserved by runtime worktree removal. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts: records GitLab pasted-project recents only after successful runtime lookup; threads explicit origin preference through runtime WSL PR base resolution; resolves local GitLab fork MR bases from the target project MR head ref; captures the fork MR head from a dedicated ref, not the shared FETCH_HEAD; keeps the durable MR head when the head fetch fails but the local ref resolves; routes runtime GitLab fork MR base git calls through the selected WSL project runtime. src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts: passes SSH connection ids through GitLab task operations; routes runtime GitLab issue, MR, work-item, and todo actions through the selected WSL project runtime; routes runtime GitLab MR details, review-management, job, and pasted URL actions through the selected WSL project runtime; normalizes runtime GitLab issue list arguments like the desktop IPC path. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts: does not warn when setup is explicitly skipped for CLI-created worktrees; puts the agent a create starts in the first default tab, as the window does; keeps the 8s main-runtime startup readiness budget for agents without an override; gives OpenCode the 20s main-runtime startup readiness budget; launches explicit startup agents with prompts for CLI-created worktrees. src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts: returns a setup launch payload for CLI-created worktrees when hooks are explicitly enabled; does not hand the window a setup main never tried to start; passes the selected Windows setup shell into runtime runner generation; follows normal setup policy for CLI-created worktrees without activating them; uses returned WSL setup shell metadata when runtime spawns setup; uses the shell-aware setup runner for windowless creates without a startup command; reports the in-process setup hook as running when nothing can launch the runner. src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts: coalesces two clients sleeping the same host worktree; stops exactly the expected live PTYs for a worktree; explains a refused workspace close instead of throwing the raw refusal enum. src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts: marks the desktop-active worktree as isActive; includes SSH-backed worktrees in the mobile worktree summary; caches repeated malformed path misses before normalizing them again. src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts: keeps title-only foreground work ahead of monitoring in another pane; keeps a local hook row while a connected PTY still backs its pane; keeps an OSC row via its connected PTY after the pane binding is cleared. src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts: resolves files through a source-visible linked-checkout worktree; marks saved session tabs with live PTYs as host sidebar activity; attributes live legacy PTYs from saved layout bindings when their panes are hidden; marks saved browser tabs as host sidebar activity like desktop; falls back to the path-keyed GitHub cache entry; includes folder workspaces in compact worktree summaries for mobile; attaches inline agent rows from the latest OSC 9999 status; projects monitoring over a title-derived working status. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts: pushes to an idle pane when the only live waiter filters out the message type; resolves a registered waiter without PTY-injecting when the leaf is already idle; keeps already-idle status after tui-idle wait for immediate message delivery; resolves message waiters when notifyMessageArrived is called; does not resolve type-filtered message waiters for unrelated message types; removes message waiter abort listeners after message arrival; resolves message waiters on timeout when no message arrives. src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts: delivers pending mail via notifyMessageArrived when the recipient is already idle; does not keep retrying when every pending row was already pointed; repoints pending rows restored with a live-idle coordinator. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts: rolls back a half-created terminal whose surface never publishes. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts: rejects startup prompts for agents that require post-ready stdin; uses portable Unix quoting for mobile agent launch commands in WSL project runtimes; keeps PowerShell quoting for mobile agent launch commands in Windows host runtimes; uses cmd.exe quoting for mobile agent launch commands in local Windows host runtimes; publishes headless mobile session agent identity with synthesized PTY status; rejects disabled mobile session agent launches before spawning; validates mobile terminal insertion anchors before resolving agent launch commands. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts: coalesces a reconnect close burst onto one authoritative PTY inventory; keeps an explicit user close destructive while the PTY is live; builds mobile session agent launch commands on the runtime host; injects mobile quick-command prompts into the host-built agent startup command. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts: closes persisted headless terminal parents before any prior list call; tears down a serve-owned headless tab on close while a renderer is attached so it cannot resurrect; defers a renderer-published pending tab to the renderer instead of tearing it down; returns a delegated close outcome with no selection tombstone when the renderer owns the outcome; tears down a runtime pending shell the renderer never adopted on close. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts: materializes a plain shell when the pending tab has no launch agent; hydrates legacy persisted terminal tabs without layout entries; reads and indexes the full agent-status snapshot once per mobile projection; kills persisted SSH PTYs when closing hydrated headless tabs before pane metadata is restored; materializes hydrated pending headless terminals with the persisted session identity. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts: hydrates a persisted SSH-owned pane before an attached renderer publishes its graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts: publishes the desktop's tab name over the live agent title, and the live title without one; uses fresh neutral PTY titles over stale mobile snapshot and OSC titles; operates PTY-backed mobile session terminals without a renderer graph; reuses pane close for live PTYs that do not own a renderer tab; lists PTY-backed mobile session terminals without a renderer graph; shows and resolves active PTY-backed mobile session terminals without a renderer graph. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts: creates mobile session terminals for folder workspaces in a headless runtime server; spawns fresh headless SSH mobile session terminals instead of reattaching synthetic local ids; hydrates headless mobile session terminals from the host workspace session; keeps live headless mobile session terminals when a desktop renderer publishes without them; publishes laptop-created remote runtime split terminals to phone session tabs. src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts: does not report headless wake degradation without sleeping records; does not wake slept agents for non-mobile session-only activation; does not rewrite unread metadata when a mobile activation finds the worktree already read; returns unread:false from worktree.ps after a mobile activation clears the flag; materializes pending mobile session terminals without focusing desktop clients; closes browser mobile session tabs when addressed by browser workspace id. src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts: resolves mobile terminal surfaces by exact split leaf; closes the matching mobile terminal UUID leaf without closing the whole tab; closes the whole mobile terminal tab when addressed by parent tab id; activates the active split leaf when addressed by parent tab id; clears unread metadata on mobile worktree activation without focusing desktop clients; wakes slept agents on the host renderer when a phone activates a worktree. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts: publishes the hook provider session on a headless mobile tab so native chat can address the transcript; recovers the agent type from the hook row when the pane was launched without an agent hint; reads one agent-status snapshot per projection, not one per terminal tab; waits for unknown-launch foreground owner before publishing Pi-compatible mobile status; keeps Pi-compatible mobile session status as Pi for an unknown-launch foreground pi PTY; keeps renderer-vetted mobile agent status for custom-titled terminals. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts: publishes terminal surface agent status for paired web clients; preserves authoritative OMP identity for Pi-compatible remote terminal snapshots; normalizes a remote OMP title without republishing omitted launch identity; skips the foreground-process probe when the PTY launch agent is already known; probes the foreground process only on a status transition for unknown launch agents; passes the client signal and the slept-worktree refusal to the spawn. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts: does not use stale runtime-created PTY status when a neutral PTY title exists; recognizes runtime-created Codex PTY handles from the ready prompt; recognizes runtime-created Antigravity PTY handles from the ready prompt; recognizes live leaf Antigravity terminals from the ready prompt; recognizes a later Antigravity header with a prompt but no model line; keeps mobile terminal surfaces visible while their leaf handle is pending. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts: lets Claude agents management titles clear stale runtime-created title status; does not recognize live Claude agents panes from a Claude foreground process; does not let stale tab-level agent titles override current neutral pane titles; lists live terminals with fresh pane titles over stale tab titles; lets adopted neutral pane titles use non-shell foreground fallback; lets adopted neutral pane titles retry wrapper foregrounds until recognized; authorizes settled CLI prompts only after positive %s foreground identity; does not recognize arbitrary foreground TUIs as running agents; lets live neutral pane titles retry wrapper foregrounds until recognized; lets current Claude agents PTY titles override stale runtime-created OSC titles; does not let stale Claude agents OSC titles suppress current PTY title activity. src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts: keeps preallocated terminal handles valid across renderer reloads; preserves runtime-created PTY process identity after graph unavailable; keeps prompt bindings fenced across runtime restarts without provider incarnation; recognizes runtime-created PTY handles with agent launch titles; does not treat a bare Cursor Agent native title as a running agent session; uses stale runtime-created PTY status when there is no title or foreground evidence. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts: keeps orphaned list and show writability aligned with the send gate. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts: cancels a coalesced SSH worker recovery retry when its provider disconnects. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts: retries renderer reveal before clearing an adopted legacy worker sleeping record. src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts: recovers exported ORCA_TERMINAL_HANDLE from discovered live PTY sessions. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts: applies ANSI erase-from-start line controls in retained previews; applies ANSI stripping for private or intermediate CSI line controls; applies ANSI stripping for unsupported erase-line modes; reveals an agent terminal under the pane the caller reserved; keeps a fresh %s pane host-owned when a desktop window is available; keeps desktop publication %s separate from the reserved host spawn; mints its own pane when the reserved leaf is malformed, and reports the one it used; starts an agent terminal with the model the caller picked; starts an agent terminal without a model flag when no pick was made; attributes a startup-agent launch named %s as %s; attributes a fresh agent session the host builds as unknown; leaves a bare agent command the user typed out of launch attribution. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts: trims oversized terminal output bursts without per-line array shifts; builds terminal previews without mapping the full retained tail; keeps recent PTY replay output capped without needing previous data for large chunks; applies terminal redraw controls before retaining previews; applies ANSI terminal redraw controls before retaining previews; retains multi-line ANSI footer redraws instead of appending old frames; keeps the cursor column when erasing full lines in multi-line redraws; applies ANSI split redraw controls without leaking raw params. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts: returns renderer visible screen lines through terminal.read RPC JSON result; separates composer drafts from provider-owned terminal screens. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts: reports an in-flight PTY focus as not navigated when its notifier disappears; reports graph-leaf focus as not navigated without a host notifier; grounds the provider mode tracker before a later chunk, in the emulator order; grounds an in-flight provider snapshot capture so it cannot publish the pre-reset screen; waits for terminal exit and resolves with the exit status; keeps terminal read payloads bounded while retained output remains pageable; trims terminal read preview character budget without per-line array shifts. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts: submits a silent Claude composer once after the bounded render fallback; chunks large terminal.send text before provider writes; yields chunked terminal input through immediates between writes; yields while validating accepted large terminal.send text before provider writes; reveals a background terminal session when focusing its handle; replays captured launch config when focusing a background agent session; reveals background terminal sessions with the freshest PTY title; renames background terminal handles without requiring a visible tab; keeps a background terminal handle stable while reveal adoption is racing. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts: resolves tui-idle when a stale Codex prompt is followed by Antigravity readiness; returns an agent-neutral blocked wait result for update prompts; returns an agent-neutral blocked wait result for workspace trust prompts; returns an agent-neutral blocked wait result for cwd selection prompts; returns a blocked wait result for Codex model migration prompts; returns a blocked wait result for Codex startup hook review prompts; returns an agent-neutral blocked wait result for generic interactive prompts; splits text and enter writes for background terminal handles; types the lead line for %s: %s; submits through the agent-specific PTY timing policy for %s. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts: waits for exit on background terminal handles; keeps retained PTY transcript memory when controller refresh fails; resolves tui-idle from an Antigravity ready prompt preview; resolves Antigravity ready prompts with newline-heavy pasted tails without splitting; resolves live-leaf tui-idle from an Antigravity ready prompt preview. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts: spawns the available Qoder command for a captured same-session resume: %s; does not use the local Windows shell setting for remote Windows bare agent creates; matches canonical bare agent commands when a command override is configured; keeps non-bare agent command terminal creates unchanged; keeps disabled bare agent command terminal creates unchanged; injects runtime hook receiver env into terminal sessions; creates background terminal sessions for a $label; creates background terminal sessions for a $label; enables Claude Agent Teams only for direct Claude launches when configured in-process; reveals Claude Agent Teams launches with the rewritten launch config; preserves Claude Agent Teams for sequenced Claude launches. src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts: creates visible terminal sessions without asking the renderer to focus a tab; asks the pty controller for the requested shell instead of a startup command; knows the agent a flagged launch command names before any process read; retires a flagged command pane identity when the command exits; retires only receipted restored PTY authority on command completion and exit; forgets synthetic handles when disconnected PTY records are pruned. src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts: returns OSC titles from headless main terminal snapshots; adopts renderer-seeded titles into headless main terminal snapshots; returns cwd metadata from seeded headless main terminal snapshots; adopts OSC7 host metadata from seeded headless terminal scrollback; falls back to the renderer snapshot for hidden-output recovery without headless state; keeps an empty headless snapshot authoritative for hidden-output recovery; advances the absolute output sequence across a daemon stream gap; emits explicit OSC 9999 agent status from runtime PTY data. src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts: falls back to the provider snapshot for a restored PTY with no mounted renderer; falls back to the available mirror when authoritative provider history is unavailable; keeps an empty renderer snapshot when the provider has no retained content; keeps restored provider history authoritative after later live output; uses provider alternate-screen state while a partial model is unsafe; prefers the tracked title over the headless emulator lastTitle; keeps the cursor-agent literal in record-fallback snapshots only without a tracker title; touches mobile snapshots once for decorative spinner ticks, again on idle. src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts: creates a same-repo PR branch override from a resolved head SHA and matching push target; skips broad remote fetch for an existing full-SHA PR base; creates a selected Bitbucket PR branch override from a matching remote branch; suffixes an existing PR when a matching push target lacks selected PR metadata; suffixes a matching push target branch when selected PR metadata has no PR number; suffixes a matching push target branch when the existing PR is different; suffixes a selected PR remote conflict when the PR lookup fails; checks out an unused runtime PR branch only when it is at the resolved head SHA; suffixes only the runtime worktree path when an exact PR branch checkout path exists. src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts: returns runtime local base update suggestions from addWorktree; creates a runtime local worktree from a usable persisted local branch base; does not create a runtime local worktree when the refresh fails and no local base ref exists; creates a branchNameOverride worktree from the selected matching remote base ref. Current changed source bytes, wrapper registrations and reduced selectors have no fresh execution or red/green credit. Unrelated surviving receipt objects keep their original narrow scope; current literal graph reachability does not establish historical import closure or equivalent replacement coverage. Current conservative command/import graph reaches src/main/runtime/construction/orca-runtime.test.ts, src/main/runtime/orca-runtime-tests/targeting-and-resilience.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases-part-02.spec.ts, src/main/runtime/orca-runtime-tests/gitlab-and-pr-bases.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts, src/main/runtime/orca-runtime-tests/worktree-setup-and-startup.spec.ts, src/main/runtime/orca-runtime-tests/terminal-sleep-and-teardown-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-summaries.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-03.spec.ts, src/main/runtime/orca-runtime-tests/mobile-creation-and-orchestration-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-12.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-07.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-02.spec.ts, src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-05.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-12.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-11.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-10.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-09.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-06.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-03.spec.ts, src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness.spec.ts, src/main/runtime/orca-runtime-tests/headless-snapshots.spec.ts, src/main/runtime/orca-runtime-tests/terminal-side-effect-facts-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts, src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts, src/main/runtime/orchestration/mailbox/routing/orchestration-mailbox-detached-routing.spec.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-delivery.test.ts, src/main/runtime/orchestration/mailbox/terminal-pointer/orchestration-mailbox-pointer-cli-command.spec.ts. Unresolved local/computed edges remain explicit debt.",
        "Audit2150: Intentionally remove the mock-fed missing-workspace recovery suite, including its persistence-failure replay, and automatic two-minute availability callback. Provider inventory, absence and durable-settlement verdicts were supplied by fixtures; these controller guard alarms are lost without replacement. Retain actual timer cancellation/overlap and held rollback-merge callbacks unchanged. Active aliases and selectors are narrowed; dated evidenceRuns remain verbatim and provide no fresh validation of reduced selectors or actual SSH/provider/disk recovery.",
        "Audit2145 accepts removal of canned runtime metadata/guard/forwarding, fake in-memory persistence, private work-count and wrapper-duplication tests from the construction/orca-runtime.test.ts aggregate, plus the two automation run-context guards from runtime-workspace-launch-contracts.test.ts. Retained race, framing, physical completion and ownership callbacks remain byte-identical. Existing commands remain valid selectors; historical receipts stay unchanged and provide no fresh validation or replacement coverage for the reduced suites."
      ],
      "promotionCriteria": [
        "Collect cross-platform and provider soak evidence with no weakened identity, transaction or bounded-work assertions."
      ],
      "demotionRule": "Keep experimental until soak and platform evidence; investigate failures without weakening ownership, late recovery, or zero-write retry evidence."
    },
    {
      "id": "terminal.macos-tcc-update-identity",
      "title": "Protected terminal reads survive macOS app-bundle replacement",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "daemon-native-signing-and-provider-contract",
      "surfaces": [
        "packaged macOS daemon launch",
        "signed bundle retirement",
        "Full Disk Access status"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1514 retires macos-folder-usage-descriptions.test.mjs: copied permission-description values, helper-name inventory and mock plutil call counts are no longer pinned. Its fixture propagation and exclusion checks are also removed; no equivalent replacement or fresh macOS TCC validation is claimed. Dated executed selectors and results remain historical receipts. Signed arm64 macOS evidence; other platforms and hosts keep the existing launcher. The test-value audit retires the unit check of precedence over supplied daemon permission-status receipts. Its direct status aggregation alarm is lost; remaining launch, packaging and signed validation evidence is not an equivalent replacement. The local-network renderer request/settings/toast forwarding check is also retired; its direct display and clicked-call alarms are lost without an equivalent replacement. Historical executed commands and results are preserved. The current focused selector was rerun on Linux during this audit; Linux coverage here is deterministic fixture execution, not native macOS TCC or signed launch. The dated macOS result is preserved as a historical receipt in knownGaps.",
      "motivatingLinks": ["https://github.com/stablyai/orca/issues/13921"],
      "invariant": "A packaged macOS daemon runs from the verified signed helper copy for its build, which the updater never touches, and never beside a job that may own the endpoint; the fork fallback still fits the startup gate. A copy is deleted only when lsof proves it unused.",
      "oracle": "Deterministic launch, fallback-deadline, per-build copy, retirement and status tests, plus the signed launcher validation recorded in #25848.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 60,
        "scope": "Deterministic focused tests."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local deterministic tests only."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Signed native experiment reproduced the update-gap denial and its absence under the stable copy (#25848); it predates the per-build copy and fixed label."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Adoption skips copying; each helper build is cloned and verified once, and later daemons reuse that copy with no copy or verify; retirement runs once per launch in the background."
      },
      "knownGaps": [
        "Audit1619 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "x64, older macOS, real ShipIt relaunch, notarized release and non-APFS copies are untested.",
        "The test-value audit retires the unit check of precedence over supplied daemon permission-status receipts. Its direct status aggregation alarm is lost; remaining launch, packaging and signed validation evidence is not an equivalent replacement. Historical executed commands and results are preserved.",
        "Historical receipt before renderer-suite removal; its original executed command, current selector, counts and results are preserved without assigning them to the shortened selector: {\"date\":\"2026-10-10\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/daemon/macos-daemon-bundle.test.ts src/main/daemon/macos-daemon-launchd.test.ts src/main/daemon/daemon-init-macos-stable-launch-fallback.test.ts src/main/daemon/macos-daemon-job-state.test.ts src/main/daemon/macos-daemon-bundle-retirement.test.ts src/main/daemon/daemon-full-disk-access-status.test.ts src/main/daemon/daemon-pty-adapter-full-disk-access.test.ts config/scripts/macos-folder-usage-descriptions.test.mjs src/renderer/src/components/settings/DeveloperPermissionsPane.test.tsx\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/daemon/macos-daemon-bundle.test.ts src/main/daemon/macos-daemon-launchd.test.ts src/main/daemon/daemon-init-macos-stable-launch-fallback.test.ts src/main/daemon/macos-daemon-job-state.test.ts src/main/daemon/macos-daemon-bundle-retirement.test.ts config/scripts/macos-folder-usage-descriptions.test.mjs src/renderer/src/components/settings/developer-permissions/DeveloperPermissionsPane.test.tsx\",\"result\":\"passed\",\"durationSeconds\":2.38,\"summary\":\"All 82 focused launch, fallback-deadline, per-build copy, retirement, status and packaging tests passed.\"}",
        "Audit1514 retires macos-folder-usage-descriptions.test.mjs: copied permission-description values, helper-name inventory and mock plutil call counts are no longer pinned. Its fixture propagation and exclusion checks are also removed; no equivalent replacement or fresh macOS TCC validation is claimed. Dated executed selectors and results remain historical receipts.",
        "Historical receipt before audit1514 suite removal, preserved without assigning results to the shortened selector: {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/daemon/macos-daemon-bundle.test.ts src/main/daemon/macos-daemon-launchd.test.ts src/main/daemon/daemon-init-macos-stable-launch-fallback.test.ts src/main/daemon/macos-daemon-job-state.test.ts src/main/daemon/macos-daemon-bundle-retirement.test.ts config/scripts/macos-folder-usage-descriptions.test.mjs\",\"currentCommand\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/daemon/executable-host/macos/testing/macos-daemon-bundle.test.ts src/main/daemon/executable-host/macos/testing/macos-daemon-launchd.test.ts src/main/daemon/providers/lifecycle/testing/daemon-init-macos-stable-launch-fallback.test.ts src/main/daemon/executable-host/macos/testing/macos-daemon-job-state.test.ts src/main/daemon/executable-host/macos/testing/macos-daemon-bundle-retirement.test.ts config/scripts/desktop-distribution/macos/macos-folder-usage-descriptions.test.mjs\",\"result\":\"passed\",\"durationSeconds\":3.14,\"summary\":\"67 focused tests passed across six suites on Linux. The same current test selector was executed with pnpm dependency verification disabled in the isolated validation checkout. These deterministic fixtures do not validate native macOS TCC, codesigning or signed-helper launch.\"}",
        "Audit1514 reran the current five-suite selector on Linux; retired permission-description suite remains absent and its historical counts are not reassigned."
      ],
      "promotionCriteria": [
        "Signed release journeys on supported macOS versions with soak history."
      ],
      "demotionRule": "Keep experimental until release and soak evidence; retain code on unexplained inspection failures."
    },
    {
      "id": "terminal-daemon.async-io-progress",
      "title": "A responding terminal daemon reports stalled asynchronous work without ending sessions",
      "maturity": "experimental",
      "protection": "none",
      "owner": "terminal-runtime",
      "layer": "host-renderer",
      "surfaces": ["daemon health", "terminal input", "terminal startup", "restart notice"],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Deterministic probe, adapter and rendered notice tests; the production probe also returned stalled in the affected macOS daemon. The remaining tests do not directly cover the spawn-health precheck or diagnostic transition logging. Physical Linux/Windows/WSL/SSH and remote notices remain gaps.",
      "motivatingLinks": ["docs/bug-reproductions/daemon-async-io-stall.md"],
      "invariant": "An authenticated responsive daemon must not pass its full spawn health check while asynchronous I/O is stalled. Detection owns at most one unfinished probe and never infers exit, replays input or restarts processes.",
      "oracle": "An uncompleted operation yields stalled while timers keep running; repeated checks add no work; completion restores healthy. The notice explains restart consequences and opens the existing review. Old and unreachable peers never yield a stalled verdict.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 15,
        "scope": "Focused deterministic tests."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "Local validation only."
      },
      "redGreenEvidence": {
        "status": "complete",
        "evidence": "Forcing a healthy timeout verdict caused 2 failing tests; restoring the detector passed focused tests. Initial native trigger remains a separate unproved gap."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "One outstanding stat per daemon even after timeout, 30-second healthy cache, no session inventory or subprocesses; UI checks coalesce, stop while hidden and dispose on unmount."
      },
      "knownGaps": [
        "Audit1623 removes low-value mocked daemon projections, scalar tables and duplicate terminal examples without equivalent replacement coverage. Per-source reviews record retained terminal content preservation, process ownership refusal and recovery boundaries together with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded.",
        "Initial runtime/native trigger and prevention fix remain unproved.",
        "Older preserved daemons require a deliberate restart before supporting this probe.",
        "Physical Linux, Windows, WSL and SSH; remote notices; collapsed sidebar surfacing."
      ],
      "promotionCriteria": [
        "Reproduce and fix the native trigger; collect cross-platform and soak evidence."
      ],
      "demotionRule": "Keep experimental until the initial trigger and cross-platform behavior are understood."
    },
    {
      "id": "agent-status.nested-provider-roster",
      "title": "Nested review CLIs cannot replace the active pane status",
      "maturity": "experimental",
      "protection": "none",
      "owner": "agent-session",
      "layer": "cross-boundary",
      "surfaces": [
        "agent hook normalization",
        "sidebar child rows",
        "mobile status snapshots",
        "saved agent resume sessions",
        "native chat transcript selection"
      ],
      "platforms": ["macos", "linux", "windows"],
      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
      "coveredPlatforms": [],
      "coveredProviders": [],
      "coverageNotes": "Audit1598 removes canned hook/terminal/provider projections, fake process/launch inventories and duplicate search fixtures without equivalent replacement coverage. Retained checks cover local HTTP token isolation, disk snapshots and in-process restarts, shell spool files/curl failures, local mux byte boundaries and SQLite/FTS admission/index/publication. WSL children, process probes and provider events remain injected; in-process restart is not crash recovery, seeded recovery is not actual crash proof, and fake budgets do not establish latency. Deleted-source tests with a removeFile collector prove admission; retained integrated indexer coverage separately exercises actual SQL deletion. Historical scope before this audit: Audit1595 removes canned hook/installer/status/capture inventories and fixture-owned command scanners without equivalent replacement coverage. Retained checks cover local filesystem/symlink/shell/pipe and TCP deadlines, ACP timeline/journal failures, naming ownership/races and numeric release helper composition; provider/remote/process inventories remain injected. Native Windows cases are platform-gated; no actual remote deployment, Fastlane/Apple API or native provider identity proof. Historical scope before this audit: Contract tests exercise local HTTP hooks, loopback SSH/WSL relay forwarding and legacy relay snapshots. No live SSH, WSL or Windows Electron execution is claimed. Daemon PTYs use the same hook ingress; folder workspace routing is covered. Hidden macOS Electron validation used the real WorktreeCardAgents component and store in a temporary harness, receiving real hook IPC: 60 nested Codex updates produced zero row mutations, retained 32 children and kept height at 1170px. Screenshots inspected; synthetic hooks, no new model-backed turn. Follow-up hidden Electron verification uses an identified foreground PTY stand-in, retains idle Claude native chat through six nested Codex hooks, reads its transcript through a mobile-scoped paired client, and returns to the terminal without a Codex error. Three recorded macOS runs and three nonrecorded Linux-container runs pass. Linux recording mode timed out during Electron startup before test execution; visual proof is from macOS. The test-value audit deletes the four-case renderer PR-refresh mock registrar and removes its entry-contract caller; nested-resume and tool/assistant registrars remain. Provider-session field projections, replay tables and the weak reminted-settlement boolean are also retired. The retained nested-provider resume case and recorded Jcode normalization-to-store path supply no equivalent replacement for lost alarms. Historical executed commands, counts and results remain historical. Audit1287 removes agent-process-presence-probe.test.ts and the blank-line example from agent-hook-spool-read.test.ts. Supplied observation/identity-callback verdicts and exact blank-line byte-consumption alarms are intentionally lost. The retained UTF8 byte-accounting and spool drain timelines are distinct alarms. Audit1412: src/main/agent-hooks/server-start-failure-lifecycle.test.ts removed. Loses startup coalescing, stop/restart ownership, bind rollback, durable status persistence and subscriber continuity alarms. No equivalent replacement is claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.",
      "motivatingLinks": [
        "User report (2026-10-15): Claude status in nwparker/SSH alternates between a 32-child roster and an empty roster when nested Codex reviews report on the inherited terminal pane.",
        "https://github.com/stablyai/orca/pull/8211",
        "https://github.com/stablyai/orca/pull/3990"
      ],
      "invariant": "A different provider inheriting an active pane key cannot replace its child roster, main turn, prompt, resume identity, model or freshness, nor mutate the owning provider caches. Same-provider children still update. Hosts advertising process ownership retain an identified idle parent until positive exit or suspension, and unavailable reads preserve ownership. Older hosts retain the previous finished/stale replacement policy; distinct execution hosts/workspaces permit replacement. WSL local and relay transports retain the same owner.",
      "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Send a full Claude child roster, interleave Codex review lifecycle/tool/approval/completion hooks, and require identical snapshots plus zero publications. A later Claude child event must retain the original prompt and roster, and a real child completion must shrink it. After Claude Stop, keep its mobile transcript and saved resume identity while its identified process remains live or unverifiable; accept the first provider replacement after confirmed exit or suspension. Replay must admit records in order, retain the file on failed admission, and concurrent starts, stop during replay, or a second stop during a queued restart must not leave a listener. Pending owner probes cannot publish or accept an old request after stop, restart, or status disable/re-enable; interrupted replay stays durable.",
      "commands": [],
      "testFiles": [],
      "assertionRefs": [],
      "evidenceRuns": [],
      "runtimeBudget": {
        "p95Seconds": 30,
        "scope": "Focused local HTTP, relay, legacy snapshot and renderer contracts; excludes package build and machine contention."
      },
      "flakeHistory": {
        "status": "not-started",
        "evidence": "New gate; no CI soak history."
      },
      "redGreenEvidence": {
        "status": "partial",
        "evidence": "Live incident records alternate between a Claude 32-child roster and a Codex empty roster. Executing the original HEAD identity function accepts a nested working status; the patched function rejects it. Local and relay HTTP roster tests pass and hidden Electron real-component proof preserves all 32 rendered children through 60 nested hooks. The idle-owner follow-up reproduced eight failing assertions across three files on the prior production paths and passes with the process-owner policy. Review also reproduced stale-suspension, duplicate-listener, second-stop queued-restart, and stale HTTP/probe publication failures before their fixes. No archived CI red/green run yet."
      },
      "performanceBudget": {
        "required": true,
        "evidence": "Main reuses the constant-time provider identity decision and publishes no rejected updates. Legacy relays retain provider-specific prompt/tool/previous-status caches, bounded by MAX_CACHED_PANES for each finite provider and cleared on pane teardown or stop; no polling or timers added. Cross-provider hooks on updated hosts reuse the bounded process probe before normalization; macOS performs one ps call per non-overlapping conflicting hook (one-second timeout), and concurrent checks share the existing pending promise."
      },
      "promotionCriteria": ["Save red/green evidence and CI soak before promotion."],
      "knownGaps": [
        "No active assertion references remain after this audit; surviving unaffected receipts record historical scope only.",
        "Audit1598 removes canned hook/terminal/provider projections, fake process/launch inventories and duplicate search fixtures without equivalent replacement coverage. Retained checks cover local HTTP token isolation, disk snapshots and in-process restarts, shell spool files/curl failures, local mux byte boundaries and SQLite/FTS admission/index/publication. WSL children, process probes and provider events remain injected; in-process restart is not crash recovery, seeded recovery is not actual crash proof, and fake budgets do not establish latency. Deleted-source tests with a removeFile collector prove admission; retained integrated indexer coverage separately exercises actual SQL deletion.",
        "Audit1595 removes canned hook/installer/status/capture inventories and fixture-owned command scanners without equivalent replacement coverage. Retained checks cover local filesystem/symlink/shell/pipe and TCP deadlines, ACP timeline/journal failures, naming ownership/races and numeric release helper composition; provider/remote/process inventories remain injected. Native Windows cases are platform-gated; no actual remote deployment, Fastlane/Apple API or native provider identity proof.",
        "A nested CLI started before any owner is observed may still establish the initial pane identity.",
        "Same-provider nested sessions remain governed by the existing process/session ownership rules.",
        "Live SSH/WSL, Windows Electron and physical mobile validation are not included.",
        "Idle-process protection needs a captured process identity and an updated execution host. Windows and older hosts retain the prior finished/stale fallback.",
        "No new model-backed Claude/Codex turn was run; hooks and transcript fixtures drive the verification.",
        "The test-value audit deletes the four-case renderer PR-refresh mock registrar and removes its entry-contract caller; nested-resume and tool/assistant registrars remain. Provider-session field projections, replay tables and the weak reminted-settlement boolean are also retired. The retained nested-provider resume case and recorded Jcode normalization-to-store path supply no equivalent replacement for lost alarms. Historical executed commands, counts and results remain historical.",
        "Audit1287 removes agent-process-presence-probe.test.ts and the blank-line example from agent-hook-spool-read.test.ts. Supplied observation/identity-callback verdicts and exact blank-line byte-consumption alarms are intentionally lost. The retained UTF8 byte-accounting and spool drain timelines are distinct alarms.",
        "Audit1287 retires this complete historical receipt after test removals; its old counts/results do not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-10-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/server-idle-process-owner.test.ts src/wsl-guest/relay-idle-process-owner.test.ts tests/e2e/nested-agent-idle-owner.unit.test.ts src/shared/agent-process-presence-probe.test.ts src/shared/agent-hook-spool-drain.test.ts src/main/agent-hooks/server-agent-presence.test.ts src/wsl-guest/relay-agent-presence.test.ts src/main/agent-hooks/server-nested-agent-roster.test.ts src/main/agent-hooks/server-nested-agent-boundaries.test.ts src/main/agent-hooks/server-nested-agent-consumers.test.ts src/main/agent-hooks/server-nested-agent-model.test.ts src/main/agent-hooks/server-ingest-remote.test.ts src/main/agent-hooks/server-hook-http-ingest.test.ts src/main/agent-hooks/server-status-listener-fanout.test.ts src/main/agent-hooks/terminal-handle-row-identity.test.ts src/renderer/src/store/slices/agent-status-nested-resume.test.ts src/wsl-guest/agent-hook-provider-normalization.test.ts src/main/agent-hooks/server-start-failure-lifecycle.test.ts src/main/agent-hooks/server-startup-lifecycle.test.ts src/main/agent-hooks/spool.test.ts src/shared/agent-hook-spool-read.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-http-owner-probe-lifecycle.test.ts src/wsl-guest/relay-http-owner-probe-lifecycle.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/server-idle-process-owner.test.ts src/wsl-guest/relay-idle-process-owner.test.ts tests/e2e/nested-agent-idle-owner.unit.test.ts src/shared/agent-status/process/agent-process-presence-probe.test.ts src/shared/agent-hook-listener/transport/agent-hook-spool-drain.test.ts src/main/agent-hooks/server-agent-presence.test.ts src/wsl-guest/relay-agent-presence.test.ts src/main/agent-hooks/server-nested-agent-roster.test.ts src/main/agent-hooks/server-nested-agent-boundaries.test.ts src/main/agent-hooks/server-nested-agent-consumers.test.ts src/main/agent-hooks/server-nested-agent-model.test.ts src/main/agent-hooks/server-ingest-remote.test.ts src/main/agent-hooks/server-hook-http-ingest.test.ts src/main/agent-hooks/server-status-listener-fanout.test.ts src/main/agent-hooks/terminal-handle-row-identity.test.ts src/renderer/src/store/slices/agent-status/agent-status-entry-contracts.test.ts src/wsl-guest/agent-hook-provider-normalization.test.ts src/main/agent-hooks/server-start-failure-lifecycle.test.ts src/main/agent-hooks/server-startup-lifecycle.test.ts src/main/agent-hooks/spool.test.ts src/shared/agent-hook-listener/transport/agent-hook-spool-read.test.ts src/wsl-guest/agent-hook-server.test.ts src/main/agent-hooks/server-http-owner-probe-lifecycle.test.ts src/wsl-guest/relay-http-owner-probe-lifecycle.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 75.69,\n          \"summary\": \"197 tests across 24 files pass after adversarial review. New regressions cover pending HTTP and process-probe publication after stop/restart/status disable/re-enable, fixed-token relay restarts, interrupted spool durability, and a second stop while a restart is queued.\"\n        }",
        "Audit1287 retires this complete historical receipt after test removals; its old counts/results do not validate the reduced suite. Original receipt verbatim:\n{\n          \"date\": \"2026-10-15\",\n          \"runner\": \"local\",\n          \"platform\": \"macos\",\n          \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/server-idle-process-owner.test.ts src/wsl-guest/relay-idle-process-owner.test.ts tests/e2e/nested-agent-idle-owner.unit.test.ts src/shared/agent-process-presence-probe.test.ts src/shared/agent-hook-spool-drain.test.ts src/main/agent-hooks/server-agent-presence.test.ts src/wsl-guest/relay-agent-presence.test.ts src/main/agent-hooks/server-nested-agent-roster.test.ts src/main/agent-hooks/server-nested-agent-boundaries.test.ts src/main/agent-hooks/server-nested-agent-consumers.test.ts src/main/agent-hooks/server-nested-agent-model.test.ts src/main/agent-hooks/server-ingest-remote.test.ts src/main/agent-hooks/server-hook-http-ingest.test.ts src/main/agent-hooks/server-status-listener-fanout.test.ts src/main/agent-hooks/terminal-handle-row-identity.test.ts src/renderer/src/store/slices/agent-status-nested-resume.test.ts src/wsl-guest/agent-hook-provider-normalization.test.ts src/main/agent-hooks/server-start-failure-lifecycle.test.ts src/main/agent-hooks/server-startup-lifecycle.test.ts src/main/agent-hooks/spool.test.ts src/shared/agent-hook-spool-read.test.ts src/wsl-guest/agent-hook-server.test.ts --maxWorkers=2\",\n          \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/server-idle-process-owner.test.ts src/wsl-guest/relay-idle-process-owner.test.ts tests/e2e/nested-agent-idle-owner.unit.test.ts src/shared/agent-status/process/agent-process-presence-probe.test.ts src/shared/agent-hook-listener/transport/agent-hook-spool-drain.test.ts src/main/agent-hooks/server-agent-presence.test.ts src/wsl-guest/relay-agent-presence.test.ts src/main/agent-hooks/server-nested-agent-roster.test.ts src/main/agent-hooks/server-nested-agent-boundaries.test.ts src/main/agent-hooks/server-nested-agent-consumers.test.ts src/main/agent-hooks/server-nested-agent-model.test.ts src/main/agent-hooks/server-ingest-remote.test.ts src/main/agent-hooks/server-hook-http-ingest.test.ts src/main/agent-hooks/server-status-listener-fanout.test.ts src/main/agent-hooks/terminal-handle-row-identity.test.ts src/renderer/src/store/slices/agent-status/agent-status-entry-contracts.test.ts src/wsl-guest/agent-hook-provider-normalization.test.ts src/main/agent-hooks/server-start-failure-lifecycle.test.ts src/main/agent-hooks/server-startup-lifecycle.test.ts src/main/agent-hooks/spool.test.ts src/shared/agent-hook-listener/transport/agent-hook-spool-read.test.ts src/wsl-guest/agent-hook-server.test.ts --maxWorkers=2\",\n          \"result\": \"passed\",\n          \"durationSeconds\": 8.34,\n          \"summary\": \"187 tests across 22 files pass on the final follow-up, covering idle process ownership, stale suspension/resume/unavailable/exit, legacy hosts, relay cache isolation, saved resume records, concurrent startup and durable ordered spool replay.\"\n        }",
        "Audit1412: src/main/agent-hooks/server-start-failure-lifecycle.test.ts removed. Loses startup coalescing, stop/restart ownership, bind rollback, durable status persistence and subscriber continuity alarms. No equivalent replacement is claimed. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []",
        "Audit1598 retains this receipt as historical scope only after removing the gate’s last active assertion reference. Receipt fields preserved verbatim:\n{\n  \"date\": \"2026-10-15\",\n  \"runner\": \"local\",\n  \"platform\": \"linux\",\n  \"command\": \"SKIP_BUILD=1 ORCA_BACKGROUND_LAUNCH=1 xvfb-run -a pnpm exec playwright test --config tests/playwright.config.ts tests/e2e/nested-agent-idle-session-owner.spec.ts --project=electron-headless --workers=1 --repeat-each=3\",\n  \"result\": \"passed\",\n  \"durationSeconds\": 51.3,\n  \"summary\": \"Three hidden Electron runs pass in an isolated Docker Ubuntu24 arm64 container on the final generation-guard build using the actual foreground PTY fixture. Native chat, paired mobile transcript, and Show terminal retain Claude identity. Original CI failure reproduced with the worker-PID fixture; corrected foreground fixture passes. Recording-enabled attempts timed out at fixture startup before test execution; attached video is from macOS.\"\n}",
        "Audit1598 retains this receipt as historical scope only after removing the gate’s last active assertion reference. Receipt fields preserved verbatim:\n{\n  \"date\": \"2026-10-15\",\n  \"runner\": \"local\",\n  \"platform\": \"macos\",\n  \"command\": \"ORCA_BACKGROUND_LAUNCH=1 ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test --config tests/playwright.config.ts tests/e2e/nested-agent-idle-session-owner.spec.ts --project=electron-headless --workers=1 --repeat-each=3\",\n  \"result\": \"passed\",\n  \"durationSeconds\": 52.2,\n  \"summary\": \"Three recorded hidden Electron runs pass using an identified stand-in process in the actual foreground PTY. Claude native chat survives six nested Codex hook types, a paired mobile client reads the same transcript, and Show terminal returns without an error. Screenshots inspected and fresh proof attached. Controlled hooks/transcript; no live model turn.\"\n}",
        "Audit1598 retains this receipt as historical scope only after removing the gate’s last active assertion reference. Receipt fields preserved verbatim:\n{\n  \"date\": \"2026-10-15\",\n  \"runner\": \"local\",\n  \"platform\": \"macos\",\n  \"command\": \"ORCA_BACKGROUND_LAUNCH=1 ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test --config tests/playwright.config.ts tests/e2e/nested-agent-idle-session-owner.spec.ts --project=electron-headless --workers=1 --repeat-each=3\",\n  \"result\": \"passed\",\n  \"durationSeconds\": 32.1,\n  \"summary\": \"Three hidden Electron runs pass. Actual native chat retains the foreground Claude reply after six nested Codex hooks; a mobile-scoped paired client reads that Claude transcript; Show terminal returns without the Codex verification error. Screenshots visually inspected and video attached to PR. Controlled hooks/transcripts with a real OS process identity; no model-backed turn or physical phone.\"\n}"
      ],
      "demotionRule": "Keep experimental until CI soak; investigate any roster loss or blocked genuine provider replacement without weakening the snapshot and publication assertions."
    }
  ]
}